EUVD-2024-55768

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

CVE-2024-11222 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

CVE-2024-11222 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

CVE-2024-11222 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

CVE-2026-73447

CVE-2026-73447 is a CRITICAL (CVSS 3.1: 9.1) OS command injection (CWE-78) in the gNSI Certz and Bootz services on Arista EOS . An authenticated user can escalate privileges to root via a crafted Certz Rotate request, leading to full device compromise . Affected versions span the 4.30.x through 4...

CVE-2026-73447 Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request

A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface gNSI Certz service on Arista EOS-based products to escalate privileges and execute arbitrary...

CVE-2026-73447 Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request

A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface gNSI Certz service on Arista EOS-based products to escalate privileges and execute arbitrary...

EUVD-2026-80209

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

CVE-2026-76559 WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

EUVD-2026-80073

A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agentsdks/python/a2uiagent/src/a2ui/extensions/fileresolve/fileresolver.py of the component FileResolver. The manipulation leads to server-side request forgery. I...

EUVD-2026-80070

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component Multimodal Content. The manipulation of the argument Value results in server-side request forger...

EUVD-2026-80059

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wanconfigsetcgi, wannumsetcgi, and lanipchangecgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38406)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to improper access control. This vulnerability stems from issues with the delParentalRules function, allowing attackers to exploit it by sending a specially crafted POST request to th...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38409)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the delStaticDhcpRules function. Attackers can exploit this vulnerability by sending a specially crafted PO...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38420)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the informSlaveUpdate function. Attackers can exploit this vulnerability by sending a specially crafted POS...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38417)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the getRoamingCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38428)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setIpPortFilterRules function. Attackers can exploit this vulnerability by sending a specially crafted...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38429)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the setLanCfg function. Attackers can exploit this vulnerability by sending specially crafted POST request...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38566)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the setWiFiAdvancedCfg function. Attackers can exploit this vulnerability by sending a specially crafted...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38573)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the setWiFiRepeaterCfg function. Attackers can exploit this vulnerability by sending a specially crafted...