PT-2026-49968

Name of the Vulnerable Software and Affected Versions MySQL Router versions 9.0.0 through 9.7.0 Description An issue in the General component of MySQL Router allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a complete...

PT-2026-49970

Name of the Vulnerable Software and Affected Versions MySQL Router versions 8.4.0 through 8.4.9 MySQL Router versions 9.0.0 through 9.7.0 Description An issue in the General component of MySQL Router allows an unauthenticated attacker with network access via TLS to compromise the system. Successf...

PT-2026-51773

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.8.7 Description Multiple security issues affect the Crawl4AI Docker API server across several functional areas: - An authentication bypass in the monitor router allows unauthenticated access to destructive...

PT-2026-50084

Name of the Vulnerable Software and Affected Versions TL-WR940N version v6 Description An authenticated OS command injection exists in the BigPond Cable BPA WAN configuration module due to improper sanitization of user input. An attacker with administrative access can exploit this flaw to execute...

EUVD-2026-36756

Tenda 5G03 V05.03.02.04 Version 1.0 is vulnerable to Command injection in the function actionimsonwithapn via the imsapn parameter...

CVE-2026-38064

Tenda 5G03 V05.03.02.04 Version 1.0 is vulnerable to Command injection in the function actiondialcall via the dialNumber parameter...

CVE-2026-38063

Tenda 5G03 V05.03.02.04 Version 1.0 is vulnerable to Command injection in the function actionradioonwithiaapn via the ia parameter...

CVE-2026-38061

Tenda 5G03 V05.03.02.04 Version 1.0 is vulnerable to Command injection in the function actionsetvolume via the volume parameter...

CVE-2026-38062

Tenda 5G03 V05.03.02.04 Version 1.0 is vulnerable to Command injection in the function actionsetratmode via the ratMode parameter...

@aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.6), @aaravpos/appointment-booking-plugin (>=1.0.1, <=8.0.2) +201 more potentially affected by CVE-2026-53663 via react-router (>=7.12.0, <=7.15.0)

react-router NPM version =7.12.0, =1.0.0, =1.0.1, =0.0.9-alpha-20260107202750-16b04dcbaa92c7fc2bbb580dbc1da723c76a5225, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.5.2, =2026.511.1, =1.0.1-MON-198407-add-selinux-sudo-check.0, =0.0.1, =2.0.0-alpha.1 and more Source cves: CVE-2026-53663 Sour...

NPM: React Router: Potential CSRF via PUT/PATCH/DELETE document requests

NPM: React Router: Potential CSRF via PUT/PATCH/DELETE document requests vulnerability discovered by ? in WordPress Npm react-router versions = 7.12.0, 7.15.1...

@aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.6), @aaravpos/appointment-booking-plugin (>=1.0.1, <=8.0.2) +201 more potentially affected by CVE-2026-53663 via react-router (>=7.12.0, <=7.15.0)

react-router NPM version =7.12.0, =1.0.0, =1.0.1, =0.0.9-alpha-20260107202750-16b04dcbaa92c7fc2bbb580dbc1da723c76a5225, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.5.2, =2026.511.1, =1.0.1-MON-198407-add-selinux-sudo-check.0, =0.0.1, =2.0.0-alpha.1 and more Source cves: CVE-2026-53663 Sour...

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight, SameSite cookies already block the cross-origin attack vectors...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to insufficient CSRF checks for PUT, PATCH, and DELETE document requests. An attacker can cause unauthorized state changes by tricking a user into submitting crafted requests from another origin. Note...

GHSA-84G9-W2XQ-VCV6 React Router: Potential CSRF via PUT/PATCH/DELETE document requests

Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight, SameSite cookies already block the cross-origin attack vectors...

EUVD-2026-36673

A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted element is the function nslookup of the file /cgi-bin/luci/api/diagnose of the component JSON-RPC Diagnose Endpoint. Performing a manipulation of the argument params.target results in command injection. It is possible to...

CVE-2026-38065

The vulnerability CVE-2026-38065 affects Tenda 5G03 devices running firmware V05.03.02.04 (Version 1.0) . A command injection exists in the function action_ims_on_with_apn via the ims_apn parameter. This is supported by multiple connected sources (NVD, ENISA EUVD, CVE listings) confirming the sam...

📄 Netis N5VN AC1200 1.0.1.1742 Buffer Overflow / Denial of Service

A buffer overflow vulnerability in the Netis N5VN AC1200 router allows an attacker to crash the web server by sending a crafted request. Version 1.0.1.1742 is affected. Exploit Title: Netis N5VN AC1200 - Buffer Overflow DOS Denial of Service Application: Netis N5VN AC1200 Router Version:...

PT-2026-49294

Name of the Vulnerable Software and Affected Versions Tenda 5G03 version V05.03.02.04 Version 1.0 Description Command injection is possible in the action radio on with ia apn function through the ia parameter. Command injection is a flaw that allows an attacker to execute arbitrary operating syst...

PT-2026-49578

Name of the Vulnerable Software and Affected Versions React Router version 7 Description Insufficient Cross-Site Request Forgery CSRF checks in Framework Mode allow bypasses when using 'PUT', 'PATCH', or 'DELETE' requests, as the checks were primarily applied to 'POST' requests. CSRF is a type of...