EUVD-2026-105328

A OS command injection vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2026-10135

A OS command injection vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2026-10135

A CRITICAL OS command injection vulnerability exists in the batchupg functionality of the Totolink X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). The root cause stems from a lack of sanitization on the filename parameter across a multi-step data flow: first, it is received via...

CVE-2026-10135

A OS command injection vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2026-10139

A stack-based buffer overflow vulnerability exists in the Mcli functionality of the Totolink X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). An authenticated attacker can trigger this by sending a specially crafted HTTP request to the /boafrm/formUpload page. The vulnerability ...

CVE-2026-10141

A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerabili...

CVE-2026-10139

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2026-10141

A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerabili...

CVE-2026-10139

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2026-10141

The Totolink X2000R (version: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is vulnerable to an Unsigned Firmware flaw in the boa Firmware Update functionality. The root cause is the improper verification of cryptographic signatures (CWE-347); while the system checks for magic bytes and checksums, i...

EUVD-2026-105324

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

EUVD-2026-105323

A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerabili...

CVE-2026-111769

In affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin. If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers such as an "X-API-Key" set in "requestInit.headers" and the...

CVE-2026-87861

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused...

CVE-2026-87861

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused...

AIOHTTP: Absolute-form request targets can spoof Request.scheme

Summary An attacker sending an absolute-form request can spoof the scheme used. Impact If user code depends on the Request.scheme attribute for anything security related, an attacker may be able to circumvent this logic, tricking the application into thinking a connection is encrypted when it is...

GHSA-F9XW-JH8M-3MWQ AIOHTTP: Absolute-form request targets can spoof Request.scheme

Summary An attacker sending an absolute-form request can spoof the scheme used. Impact If user code depends on the Request.scheme attribute for anything security related, an attacker may be able to circumvent this logic, tricking the application into thinking a connection is encrypted when it is...

CVE-2026-111756

A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, untrusted server can exploit this flaw by issuing a redire...

GHSA-PQXQ-W44R-73XW AIOHTTP: Pure-Python parser request smuggling

Summary The pure Python parser is vulnerable to an HTTP request smuggling attack. Impact If users are using the Python parser AIOHTTPNOEXTENSIONS, or not a standard wheel installed, then an application may be vulnerable to a request smuggling attack. Workaround Switch to the default C parser...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the pure-Python HTTP request parser in aiohttp/httpparser.py, where the method variable used to determine whether a request body should be treated as empty is incorrectly sourced from a local parameter rather...