320325 matches found
CVE-2026-58146
WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the clicookie POST parameter. The clicookie parameter value is directly concatenated into a find command string without proper...
CVE-2026-40857
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery CSRF vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrftokenvalue parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the...
CVE-2026-58146
WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the clicookie POST parameter. The clicookie parameter value is directly concatenated into a find command string without proper...
CVE-2026-58146 Unauthorized remote code execution in T-Mobile 5G Box IDU routers
WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the clicookie POST parameter. The clicookie parameter value is directly concatenated into a find command string without proper...
EUVD-2026-80673
WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the clicookie POST parameter. The clicookie parameter value is directly concatenated into a find command string without proper...
CVE-2026-40857 CSRF token bypass in T-Mobile 5G Box IDU routers
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery CSRF vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrftokenvalue parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the...
EUVD-2026-80672
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery CSRF vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrftokenvalue parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the...
CVE-2026-40857
WNC T-Mobile 5G Box IDU router contains a cross-site request forgery CSRF vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrftokenvalue parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the...
CVE-2026-90017
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...
CVE-2026-89995
In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dmadirectallocfrompool Commit 5b138c534fda "dma-direct: factor out a dmadirectallocfrompool helper" changed dmadirectallocfrompool to return the CPU address from dmaallocfrompool. That fits...
CVE-2026-89964
In the Linux kernel, the following vulnerability has been resolved: parisc: eisa: Fix infinite loop when parsing invalid IRQ value When an invalid value is passed via the "eisairqedge=" kernel command line parameter e.g. "eisairqedge=16,5", eisairqsetup prints an error message and continues witho...
CVE-2026-89952
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...
CVE-2026-89796
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid infinite kdamondmergeregions internal loop Patch series "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races", v1.1. Sashiko found a few issues in DAMON that could cause infinite loop, NULL...
CVE-2026-90017
CVE-2026-90017 affects the rtl8723bs staging driver in the Linux kernel . The function rtw_action_frame_parse() receives a frame_len parameter but never validates it before indexing into the frame body. Because frame_body is offset 24 bytes into the frame, reading frame_body[0] and frame_body[1] ...
EUVD-2026-80625
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...
CVE-2026-90017 staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...
CVE-2026-89995 dma-direct: return struct page from dma_direct_alloc_from_pool()
In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dmadirectallocfrompool Commit 5b138c534fda "dma-direct: factor out a dmadirectallocfrompool helper" changed dmadirectallocfrompool to return the CPU address from dmaallocfrompool. That fits...
CVE-2026-89995
CVE-2026-89995 affects the Linux kernel DMA direct subsystem. The root cause is a type mismatch introduced by commit 5b138c534fda, which changed dma_direct_alloc_from_pool() to return a CPU address instead of a struct page *. This broke dma_direct_alloc_pages(), which expects a struct page * from...
EUVD-2026-80603
In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dmadirectallocfrompool Commit 5b138c534fda "dma-direct: factor out a dmadirectallocfrompool helper" changed dmadirectallocfrompool to return the CPU address from dmaallocfrompool. That fits...
EUVD-2026-80564
In the Linux kernel, the following vulnerability has been resolved: parisc: eisa: Fix infinite loop when parsing invalid IRQ value When an invalid value is passed via the "eisairqedge=" kernel command line parameter e.g. "eisairqedge=16,5", eisairqsetup prints an error message and continues witho...