EUVD-2026-83448

A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed...

EUVD-2026-83453

A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available a...

PT-2026-95746

Name of the Vulnerable Software and Affected Versions Forminator Forms versions prior to 1.57.3 Description Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before running the do shortcode function. This issue is triggered via the...

PT-2026-95749

Name of the Vulnerable Software and Affected Versions Totolink A3002MU version Hh-B20211125.1046 Description A buffer overflow occurs in the formWlWds function within the /boafrm/formWlWds file. This issue is triggered by the manipulation of the submit-url argument, allowing a remote attacker to...

CVE-2026-93741: Buffer Copy without Checking Size of Input

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possible to launch the attack remotely. The exploit has...

PT-2026-95741

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.9 Description The Tutor LMS plugin for WordPress contains a Reflected Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject...

CVE-2026-7527: URL Redirection to Untrusted Site

The WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially...

PT-2026-95791

Name of the Vulnerable Software and Affected Versions WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress versions prior to 7.0.03 Description An Open Redirect issue exists because the plugin fails to properly validate user input. Unauthenticated attackers can redirect users to...

CVE-2026-93740

A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available a...

CVE-2026-93739

A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed...

CVE-2026-93740 Totolink A3002MU formWlEncrypt buffer overflow

A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available a...

CVE-2026-93740 Totolink A3002MU formWlEncrypt buffer overflow

A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available a...

CVE-2026-93740

CVE-2026-93740 affects the Totolink A3002MU wireless router (firmware Hh-B20211125.1046 ). The vulnerability resides in the formWlEncrypt function within the file /boafrm/formWlEncrypt . Manipulating the submit-url argument triggers a buffer overflow , which can be exploited remotely without auth...

CVE-2026-93739 Totolink A3002MU formWlAc buffer overflow

A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed...

CVE-2026-93739

A buffer overflow in the formWlAc function of the file /boafrm/formWlAc on the Totolink A3002MU router (firmware Hh-B20211125.1046 ) can be triggered remotely by manipulating the submit-url argument. The vulnerability is rated CVSS 3.1: 9.9 CRITICAL (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with proo...

CVE-2026-93739 Totolink A3002MU formWlAc buffer overflow

A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed...

CVE-2026-91127

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escapin...

Obot: Server-Side Request Forgery via remote MCP server URL

Summary In affected versions, the URL of a remote MCP server is attacker-controlled at registration and is fetched server-side with no validation of the destination. There is no guard against loopback, link-local, RFC1918 private ranges, or the cloud metadata endpoint 169.254.169.254, so a use wi...

CVE-2026-91147

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws c...

DEBIAN-CVE-2026-91147

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws c...