Tenda AC7 stack buffer overflow vulnerability

The Tenda AC7 is a 1200m1 11ac dual-band wireless router designed for large households undergoing broadband upgrades and router replacements. The Tenda AC7 has a stack buffer overflow vulnerability. This vulnerability stems from the GoForm/AdvSetMacMtuWan function failing to correctly verify the...

Multiple Mozilla Product Permissions Enhancement Vulnerabilities (CNVD-2026-26106)

Mozilla Firefox is an open-source web browser. Mozilla Firefox ESR is a extended support version of Firefox the web browser. Mozilla Thunderbird is an email client software that was separated from the Mozilla Application Suite. Several Mozilla products have vulnerabilities related to privilege...

OpenClaw permission licensing and access control vulnerabilities (CNVD-2026-26891)

OpenClaw is an intelligent artificial assistant open-sourced by the OpenClaw team. OpenClaw has vulnerabilities related to permission management and access control. These vulnerabilities stem from environmental variable injection issues. The .env STATEDIRECTORY environment variable may affect the...

Dell PowerFlex Manager SQL injection vulnerability

Dell PowerFlex Manager is an infrastructure management platform developed by Dell Corporation, used to manage powerflex storage and computing resources. Dell PowerFlex Manager has a SQL injection vulnerability. This vulnerability stems from improper filtering of submitted SQL statements. A remote...

OpenBSD src mpls_do_error function out-of-bounds read vulnerability

OpenBSD src is a base source code package used for building the OpenBSD operating system, containing implementations of the kernel and core components. OpenBSD src has a out-of-bounds read vulnerability. This vulnerability stems from the mplsdoerror function failing to properly handle a specially...

Mozilla Firefox for iOS: Input validation error vulnerability

Mozilla Firefox for iOS is a mobile web browser developed by the Mozilla Foundation. Mozilla Firefox for iOS has a vulnerability related to input validation. This vulnerability stems from a problem in TemporaryDocument where cross-source HTTP redirection retains the initial PDF request settings f...

Adobe DNG Software Development Kit (SDK) heap buffer overflow vulnerability (CNVD-2026-26864)

The Adobe DNG Software Development Kit SDK is a software development toolkit launched by Adobe Inc. The Adobe DNG Software Development Kit SDK contains a heap buffer overflow vulnerability, allowing attackers to execute arbitrary code within the context of the current user...

Adobe DNG Software Development Kit (SDK) Out-of-Bounds Vulnerability (CNVD-2026-26858)

The Adobe DNG Software Development Kit SDK is a software development toolkit launched by Adobe Inc. The Adobe DNG Software Development Kit SDK has a out-of-bounds vulnerability, allowing attackers to access sensitive memory information...

OpenClaw path traversal vulnerability (CNVD-2026-25114)

OpenClaw is an intelligent artificial assistant open-sourced by the OpenClaw team. OpenClaw has a path traversal vulnerability. This vulnerability arises because the maintenance task execution process allows workspace-derived service paths to affect the selection of the trash command. Attackers c...

OpenClaw input validation error vulnerability (CNVD-2026-26104)

OpenClaw is an intelligent artificial assistant open-sourced by the OpenClaw team. OpenClaw has a vulnerability related to input validation, which stems from insufficient cleaning in the host environment cleaner. This vulnerability allows Node.js control variables to bypass validation. Attackers...

AI systems have vulnerabilities related to information leakage

Browse AI is a leading data scraping tool, providing reliable data to over 770,000 users worldwide. It helps them scrape, monitor, and integrate data from almost any website with little or no coding knowledge. Browse AI has a vulnerability related to information leakage, allowing attackers to...

Zhejiang Dahua Technology Co., Ltd.'s DSS has a file upload vulnerability

Zhejiang Dahua Technology Co., Ltd. is a provider and operator of intelligent IoT solutions, with video as its core technology. Zhejiang Dahua Technology Co., Ltd. DSS has a file upload vulnerability; attackers can exploit this vulnerability to upload files with any extension...

LangGenius, Inc. Dify has SSRF and arbitrary file writing vulnerabilities.

Dify is an open-source LLM application development platform. LangGenius, Inc. Dify has SSRF and arbitrary file writing vulnerabilities. Attackers can exploit these vulnerabilities to compromise the confidentiality and integrity of the system...

LangGenius, Inc. Dify has an SSRF vulnerability

Dify is an open-source LLM application development platform. LangGenius, Inc. Dify has an SSRF vulnerability, which allows attackers to obtain sensitive information...

Kylin Software Co., Ltd.'s has a vulnerability regarding arbitrary file writing.

The Galaxy Kylin Desktop Operating System is a domestic operating system. There is a vulnerability in the Galaxy Kylin Desktop Operating System developed by Kylin Software Co., Ltd. Attackers can exploit this vulnerability to write arbitrary files and execute arbitrary commands, thereby...

LangGenius, Inc. Dify has an SSRF vulnerability (CNVD-C-2026-287908)

Dify is an open-source LLM application development platform. LangGenius, Inc. Dify has an SSRF vulnerability, which allows attackers to obtain sensitive information...

Beijing Yiwuyun Data Technology Co., Ltd.'s ABC website building system has logical defects and vulnerabilities.

Beijing Yiwuyun Data Technology Co., Ltd. is an innovative company dedicated to providing basic internet data services and data operations for small and medium-sized enterprises. There are logical defects and vulnerabilities in Beijing Yiwuyun Data Technology Co., Ltd.'s ABC website construction...

Google Chrome Views component resource management error vulnerability (CNVD-2026-25115)

Google Chrome is a web browser developed by Google. Its main features include providing a fast, secure, and stable browsing experience. Google Chrome has a resource management vulnerability. This vulnerability stems from the Views component failing to properly handle the object lifecycle when...

Shanghai Shangpi Network Technology Co., Ltd.'s ECShop shopping system has a command execution vulnerability (CNVD-C-2026-281715).

The ECShop mall system is an open-source mall system. The ECShop mall system developed by Shanghai Shangpi Network Technology Co., Ltd has a command execution vulnerability. Attackers can exploit this vulnerability to execute arbitrary commands...

Beijing Xin'an Century Technology Co., Ltd.'s AG security access gateway has a format string vulnerability.

Beijing Xin'an Century Technology Co., Ltd. referred to as Xin'an Century was established in August 2001. It is a leading provider of information security products and solutions in China. Beijing Xin'an Century Technology Co., Ltd. has a format string vulnerability in its AG security access...

Zhongke Fangde Software Co., Ltd.'s Fangde Desktop Operating System has a local privilege escalation vulnerability

Fangde Desktop Operating System is a domestic operating system developed by Zhongke Fangde Software Co., Ltd. Zhongke Fangde Software Co., Ltd.’s Fangde Desktop Operating System has a local privilege escalation vulnerability, which allows attackers to exploit this vulnerability to gain higher...

Google Chrome Resource Management Error Vulnerability (CNVD-2026-25122)

Google Chrome is a web browser developed by Google Inc. of the United States. Google Chrome has a resource management vulnerability, which stems from a problem with reusing resources after they are released in the Autofill component. A remote attacker can exploit this vulnerability to destroy the...

Beijing Starnet Gigabit Technology Co., Ltd.'s RG-EAP201 has a command execution vulnerability.

RG-EAP201 is an enterprise-level wireless access point, featuring single-band 300M transmission capabilities, POE power supply support, and intelligent networking without the need for an AC power supply. Beijing StarNet Realtek Network Technology Co., Ltd.'s RG-EAP201 has a command execution...

Google Chrome Input Validation Vulnerability (CNVD-2026-25121)

Google Chrome is a web browser developed by Google, offering fast and secure web browsing features. Google Chrome has a vulnerability related to input validation, which stems from improper implementations in the DevTools component. Attackers can exploit this vulnerability to achieve sandbox escap...

Zhongke Fangde Software Co., Ltd.'s Fangde Desktop Operating System has a local privilege escalation vulnerability (CNVD-C-2026-281769).

Fangde Desktop Operating System is a domestic operating system designed for compatibility with domestic CPUs such as Haiguang, Zhaoxin, Feiteng, Loongson, Shenwei, and Kunpeng. It supports mainstream architectures like x86, ARM, and MIPS. There is a local privilege escalation vulnerability in...

Google Chrome Codecs Heap Buffer Overflow Vulnerability (CNVD-2026-25119)

Google Chrome is a web browser based on the Chromium kernel, primarily offering web browsing capabilities and a rich ecosystem of plugins. Google Chrome has a heap buffer overflow vulnerability. This vulnerability stems from the Codecs component failing to properly handle carefully crafted HTML...

Google Chrome Video Component Buffer Overflow Vulnerability (CNVD-2026-25118)

Google Chrome Video is a component that handles video decoding and rendering, primarily used to support video playback in the Chrome browser on ChromeOS. The Google Chrome Video component has a security vulnerability. This vulnerability stems from an improper check of boundaries during video data...

Google Chrome GPU resource management error vulnerability (CNVD-2026-25117)

Google Chrome is a cross-platform web browser developed by Google. It is primarily used for accessing web pages, running web applications, and providing various extended features. There is a resource management vulnerability in Google Chrome, which stems from improper handling of references after...

Zhongke Fangde Software Co., Ltd.'s Fangde Desktop Operating System has a local privilege escalation vulnerability (CNVD-C-2026-281778).

Fangde Desktop Operating System is a domestic operating system designed for compatibility with domestic CPUs such as Haiguang, Zhaoxin, Feiteng, Loongson, Shenwei, and Kunpeng. It supports mainstream architectures like x86, ARM, and MIPS. There is a local privilege escalation vulnerability in...

TP-Link Tapo C110 has a vulnerability related to formatted string errors

The TP-Link Tapo C110 is an indoor network camera produced by TP-Link Corporation. The TP-Link Tapo C110 v2 has a vulnerability related to formatted string handling. This vulnerability stems from improper processing of user control inputs in the ONVIF service. Attackers can exploit this...

Google Chrome Input Validation Vulnerability (CNVD-2026-25120)

Google Chrome is a cross-platform web browser developed by Google. It is primarily used for accessing the internet and running web applications. Google Chrome has a security vulnerability that stems from improper handling of implementation logic in extensions. A remote attacker can exploit this...

Google Chrome Resource Management Error Vulnerability (CNVD-2026-25123)

Google Chrome is a web browser developed by Google. It primarily provides features for web browsing, extension support, and multi-platform synchronization. There is a resource management vulnerability in Google Chrome. This vulnerability stems from the Cast component’s failure to properly handle...

Google Chrome VideoCapture Out-of-Bounds Reading Vulnerability (CNVD-2026-25116)

Google Chrome is a cross-platform web browser developed by Google. It primarily offers functions such as web browsing, extension support, and multi-tab management. Google Chrome has a privilege escalation vulnerability, which stems from the VideoCapture component failing to properly validate memo...

Google Chrome Input Validation Vulnerability (CNVD-2026-25124)

Google Chrome is a cross-platform web browser developed by Google, primarily used for accessing internet content. Google Chrome has a vulnerability related to input validation. This vulnerability stems from the Accessibility module’s failure to properly validate untrusted inputs. Attackers can...

Beijing Shenzhou Shihan Technology Co., Ltd.'s multimedia integrated business display system has a SQL injection vulnerability.

Beijing Shenzhou Shihan Technology Co., Ltd. was established in 2010. It is a company specializing in information-based products and solutions for smart hospitals, commercial intelligent screens, and smart education. Beijing Shenzhou Shihan Technology Co., Ltd. has a SQL injection vulnerability i...

Huawei HarmonyOS Authorization Issues Vulnerability (CNVD-2026-25139)

Huawei HarmonyOS is an operating system developed by Huawei Technologies Co., Ltd. It is a full-scenario distributed operating system based on a microkernel architecture. There are vulnerabilities related to authorization in HUAWEI HarmonyOS. These vulnerabilities stem from the permission control...

Adobe Experience Manager Cross-Site Script Vulnerability (CNVD-2026-24904)

Adobe Experience Manager is a content management solution developed by Adobe Inc. in the United States. It can be used to build websites, mobile applications, and forms. This solution supports mobile content management, marketing and sales activity management, and multi-site management, among oth...

NVIDIA DALI heap buffer overflow vulnerability

NVIDIA DALI is an open-source library for data loading and preprocessing, primarily used to accelerate image and video processing in deep learning workflows. NVIDIA DALI has a heap buffer overflow vulnerability. This vulnerability stems from improper handling of input data within certain...

Microsoft Excel code execution vulnerability (CNVD-2026-24915)

Microsoft Excel is a spreadsheet software within the Office suite developed by the American company Microsoft. There is a code execution vulnerability in Microsoft Excel, and attackers can exploit this vulnerability to execute arbitrary code on the system...

Huawei HarmonyOS network management module has a vulnerability related to improper permission management

Huawei HarmonyOS is an operating system developed by Chinese company Huawei. It is a full-scenario distributed operating system based on a microkernel architecture. The network management module of Huawei HarmonyOS has a vulnerability related to improper permission management. This vulnerability...

Huawei HarmonyOS SMS app path traversal vulnerability

Huawei HarmonyOS is an operating system developed by Chinese company Huawei. It is a full-scenario distributed operating system based on a microkernel architecture. The Huawei HarmonyOS SMS app contains a path traversal vulnerability, which can be exploited by attackers to compromise the system’s...

Adobe Experience Manager Cross-Site Script Vulnerability (CNVD-2026-24900)

Adobe Experience Manager is a content management solution developed by Adobe Inc. in the United States. It can be used to build websites, mobile applications, and forms. This solution supports mobile content management, marketing and sales activity management, and multi-site management, among oth...

Adobe Experience Manager Cross-Site Script Vulnerability (CNVD-2026-24907)

Adobe Experience Manager is a content management solution developed by Adobe Inc. in the United States. It can be used to build websites, mobile applications, and forms. This solution supports mobile content management, marketing and sales activity management, and multi-site management, among oth...

Adobe Experience Manager Cross-Site Script Vulnerability (CNVD-2026-24909)

Adobe Experience Manager is a content management solution developed by Adobe Inc. in the United States. It can be used to build websites, mobile applications, and forms. This solution supports mobile content management, marketing and sales activity management, and multi-site management, among oth...

Adobe Substance3D Sampler out-of-bound write vulnerability (CNVD-2026-24899)

Adobe Substance3D Sampler is a rendering software for 3D scenes developed by Adobe Inc. Adobe Substance3D Sampler has a out-of-bounds write vulnerability, allowing attackers to execute arbitrary code within the current user environment...

Tenda W15E formPortalAuth function buffer overflow vulnerability

The Tenda W15E is a wireless router produced by the Chinese company Tenda. The Tenda W15E version 15.11.0.10 has a buffer overflow vulnerability. This vulnerability stems from the faulty handling of the gotoUrl parameter in the formPortalAuth function, which fails to properly validate the length ...

Tenda W20E formCropAndSetWewifiPic function: PicCropName parameter buffer overflow vulnerability

Tenda W20E is a router produced by the Chinese company Tenda. The Tenda W20E has a buffer overflow vulnerability in the formCropAndSetWewifiPic function, specifically with respect to the picCropName parameter. An attacker can exploit this vulnerability to cause a denial-of-service attack...

Tenda W15E formAddWebAuthWhiteUser function: Buffer overflow vulnerability in the webAuthWhiteUserInfo parameter

Tenda W15E is a wireless router produced by the Chinese company Tenda. The Tenda W15E has a buffer overflow vulnerability in the webAuthWhiteUserInfo parameter. Attackers can exploit this vulnerability to cause denial-of-service attacks through specially crafted HTTP requests...

Tenda W15E formCropAndSetWewifiPic function: PicCropName parameter buffer overflow vulnerability

Tenda W15E is a wireless router produced by the Chinese company Tenda. The Tenda W15E has a buffer overflow vulnerability in the formCropAndSetWewifiPic function, specifically with respect to the picCropName parameter. Attackers can exploit this vulnerability to cause a service denial through...

Tenda W15E formModifyWebAuthWhiteUser function has a buffer overflow vulnerability in the webAuthWhiteID parameter

The Tenda W15E is a wireless router produced by the Chinese company Tenda. The Tenda W15E has a buffer overflow vulnerability in the webAuthWhiteID function. An attacker can exploit this vulnerability to cause a denial-of-service attack...