Lucene search
+L

10229 matches found

CVE
CVE
added 2026/04/12 11:15 p.m.28 views

CVE-2026-6135

CVE-2026-6135 affects Tenda F451 firmware 1.0.0.7_cn_svn7958, specifically the fromSetIpBind function in /goform/SetIpBind. The vulnerability arises from manipulating the argument page, leading to a stack-based buffer overflow. Exploitation is described as possible from remote and the exploit is ...

9CVSS7.9AI score0.00623EPSS
SaveExploits0References5Affected Software1
Vulnrichment
Vulnrichment
added 2026/04/12 10:30 p.m.4 views

CVE-2026-6132 Totolink A7100RU CGI cstecgi.cgi setLedCfg os command injection

A vulnerability was determined in Totolink A7100RU 7.4cu.2313b20191024. Affected by this issue is the function setLedCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument enable causes os command injection. Remote exploitation of the attack is...

10CVSS5.5AI score0.02175EPSS
SaveExploits0References5
Microsoft CVE
Microsoft CVE
added 2026/04/12 8:1 a.m.12 views

LIBPNG has a yse-after-free in png_set_PLTE, png_set_tRNS and png_set_hIST leading to corrupted chunk data and potential heap information disclosure

...

5.1CVSS5.8AI score0.00195EPSS
SaveExploits1
EUVD
EUVD
added 2026/04/12 6:30 a.m.22 views

EUVD-2026-21708

A vulnerability has been found in Totolink A7100RU 7.4cu.2313b20191024. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument ip leads to os command injection. Remote exploitation of the attack is...

10CVSS5.4AI score0.01803EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/04/12 6:30 a.m.18 views

EUVD-2026-21705

A vulnerability was detected in Totolink A7100RU 7.4cu.2313b20191024. Affected by this issue is the function setNetworkCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument proto results in os command injection. The attack may be initiated...

10CVSS5.6AI score0.01803EPSS
SaveExploits0References6
OSV
OSV
added 2026/04/12 5:23 a.m.10 views

MGASA-2026-0096 Updated libpng12 packages fix security vulnerability

LIBPNG has a heap buffer overflow in pngsetquantize. CVE-2026-25646...

8.3CVSS6.2AI score0.00955EPSS
SaveExploits1References3
NVD
NVD
added 2026/04/12 4:16 a.m.9 views

CVE-2026-6112

A weakness has been identified in Totolink A7100RU 7.4cu.2313b20191024. Affected is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument maxRtrAdvInterval causes os command injection. The attack can be initiated remotely. The...

10CVSS0.01766EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/04/12 4:15 a.m.3 views

CVE-2026-6116

A vulnerability has been found in Totolink A7100RU 7.4cu.2313b20191024. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument ip leads to os command injection. Remote exploitation of the attack is...

10CVSS6.8AI score0.01803EPSS
SaveExploits0References5Affected Software1
CVE
CVE
added 2026/04/12 3:30 a.m.28 views

CVE-2026-6114

Totolink A7100RU (firmware 7.4cu.2313_b20191024) is affected via the CGI Handler function setNetworkCfg in /cgi-bin/cstecgi.cgi. Manipulating the proto argument yields an OS command injection, with remote feasibility. Public exploit exists (exploit code maturity: PROOF-OF-CONCEPT; CVSSv3.1 base 9...

10CVSS7.1AI score0.01803EPSS
SaveExploits0References5
Microsoft CVE
Microsoft CVE
added 2026/04/11 8:10 a.m.8 views

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

...

7CVSS5.8AI score0.00206EPSS
SaveExploits2
EUVD
EUVD
added 2026/04/10 8:18 p.m.20 views

EUVD-2026-21594

LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete proto Guard in Internal lodash set...

5.6CVSS5.8AI score0.00313EPSS
SaveExploits1References3
OSV
OSV
added 2026/04/10 8:18 p.m.12 views

GHSA-FW9Q-39R9-C252 LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`

GHSA-fw9q-39r9-c252: Prototype Pollution via Incomplete Lodash set Guard in langsmith-sdk Severity: Medium CVSS 5.6 Status: Fixed in 0.5.18 --- Summary The LangSmith JavaScript/TypeScript SDK langsmith contains an incomplete prototype pollution fix in its internally vendored lodash set utility. T...

5.6CVSS5.8AI score0.00313EPSS
SaveExploits1References5
Github Security Blog
Github Security Blog
added 2026/04/10 8:18 p.m.46 views

LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`

GHSA-fw9q-39r9-c252: Prototype Pollution via Incomplete Lodash set Guard in langsmith-sdk Severity: Medium CVSS 5.6 Status: Fixed in 0.5.18 --- Summary The LangSmith JavaScript/TypeScript SDK langsmith contains an incomplete prototype pollution fix in its internally vendored lodash set utility. T...

9.8CVSS5.8AI score0.00313EPSS
SaveExploits1References5Affected Software1
NVD
NVD
added 2026/04/10 8:16 p.m.14 views

CVE-2026-40190

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK langsmith contains an incomplete prototype pollution fix in its internally vendored lodash set utility. The baseAssignValue function only guards against the...

9.8CVSS0.00313EPSS
SaveExploits1References1
RedHat Linux
RedHat Linux
added 2026/04/10 8:15 p.m.7 views

libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use TOCTOU race condition in the capsetfile function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so,...

7CVSS6.7AI score0.00206EPSS
SaveExploits2References5
Vulnrichment
Vulnrichment
added 2026/04/10 7:47 p.m.4 views

CVE-2026-40190 LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK langsmith contains an incomplete prototype pollution fix in its internally vendored lodash set utility. The baseAssignValue function only guards against the...

5.6CVSS5.8AI score0.00313EPSS
SaveExploits1References1
CVE
CVE
added 2026/04/10 7:47 p.m.83 views

CVE-2026-40190

The CVE-2026-40190 issue affects LangSmith JavaScript/TypeScript SDK (langsmith) prior to 0.5.18, where an incomplete prototype pollution fix in the vendored lodash set() allows traversal via constructor.prototype, enabling an attacker who controls data keys processed by createAnonymizer() to pol...

9.8CVSS5.8AI score0.00313EPSS
SaveExploits1References1Affected Software1
Cvelist
Cvelist
added 2026/04/10 7:47 p.m.39 views

CVE-2026-40190 LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK langsmith contains an incomplete prototype pollution fix in its internally vendored lodash set utility. The baseAssignValue function only guards against the...

5.6CVSS0.00313EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/04/10 7:22 p.m.10 views

CVE-2025-50649

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper input validation in the vlanname parameter in the /shutset.asp endpoint...

7.5CVSS6AI score0.00516EPSS
SaveExploits0References1
OSV
OSV
added 2026/04/10 7:22 p.m.4 views

GHSA-FVXX-GGMX-3CJG PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars

Summary deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openaimodel, openaikey, and openaibase without validating that these values do not contain commas. gcloud uses a comma as the key-value pair separator for...

8.4CVSS6AI score0.00231EPSS
SaveExploits1References4
Rows per page
Query Builder