Google Chrome Information Leakage Vulnerability (CNVD-2026-31526)

Google Chrome is a web browser developed by the American company Google. Google Chrome has a vulnerability related to information leakage, which is caused by out-of-bounds reading in the ANGLE framework. Attackers can exploit this vulnerability to obtain sensitive information...

Google Chrome WebXR memory error reference vulnerability (CNVD-2026-23392)

Google Chrome is a web browser developed by Google. It supports multi-platform use and emphasizes security and performance. Google Chrome has a memory error reference vulnerability. This vulnerability stems from the WebXR component’s failure to properly handle object lifecycle, resulting in memor...

WordPress plugin Easy Prism Syntax Highlighter: Cross-site scripting vulnerability

WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the functionality of WordPress. The WordPress plugin Easy Prism Syntax Highlighter ha...

WordPress plugin Endless Scroll cross-site scripting vulnerability

WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed to extend the functionality of the platform. The Endless Scroll plugin has a...

Google Chrome Code Execution Vulnerability (CNVD-2026-31524)

Google Chrome is a web browser developed by Google Inc. of the United States. Google Chrome has a code execution vulnerability, which stems from out-of-bounds memory access in the ANGLE library. Attackers can exploit this vulnerability to execute arbitrary code within a sandbox through specially...

Google Chrome ANGLE component out-of-bounds write vulnerability (CNVD-2026-23393)

Google Chrome is a cross-platform web browser developed by Google. Google Chrome’s Angular components have a out-of-bounds write vulnerability. This vulnerability stems from improper boundary checking during the processing of HTML pages in versions prior to 148.0.7778.216. Attackers can exploit...

Google Chrome ANGLE integer overflow vulnerability

Google Chrome is a web browser developed by the American company Google. Google Chrome contains an integer overflow vulnerability, which allows attackers to execute arbitrary code on the system...

WordPress plugin CM Ad Changer has a cross-site request fraud vulnerability

WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed on a WordPress site. The WordPress plugin CM Ad Changer has a cross-site...

WordPress plugin Dideo cross-site scripting vulnerability

WordPress is a blog platform developed using the PHP language. It allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the functionality of WordPress. The WordPress plugin Dideo has a cross-site scripting vulnerability...

WordPress plugin Firebase Support and Chat Management has unknown vulnerabilities

This platform has the capability to set up personal blog websites on a server based on PHP and MySQL. A WordPress plugin is an application plugin. There is a security vulnerability in the WordPress plugin “Firebase Support and Chat Management.” This vulnerability stems from the fact that the...

WordPress Plugin: Cryptocurrency Price Comparison Widget Cross-site Script Vulnerability

WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed to enhance the functionality of the platform. The WordPress plugin...

WordPress Plugin Formidable Kinetic Cross-site Scripting Vulnerability

WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed on a WordPress site. The Formidable Kinetic plugin has a cross-site scriptin...

WordPress plugin Felan Framework cross-site scripting vulnerability

WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the functionality of WordPress. The WordPress plugin Felan Framework has a cross-site...

Google Chrome Information Leakage Vulnerability (CNVD-2026-31525)

Google Chrome is a web browser developed by the American company Google. Google Chrome has a vulnerability related to information leakage, which is caused by out-of-bound reads in Dawn. Attackers can exploit this vulnerability to obtain sensitive information...

Beijing Shenzhou Shihan Technology Co., Ltd. has a SQL injection vulnerability in its multimedia integrated business display system (CNVD-C-2026-244712).

Beijing Shenzhou Shihan Technology Co., Ltd. is a company that specializes in the field of visualization. The multimedia integrated business display system of Beijing Shenzhou Shihan Technology Co., Ltd. has a SQL injection vulnerability, and attackers can exploit this vulnerability to obtain...

WordPress Plugin Content Slideshow Cross-site Scripting Vulnerability

WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the functionality of WordPress. The Content Slideshow plugin has a cross-site scripti...

Google Chrome ANGLE Memory Error Reference Vulnerability (CNVD-2026-23395)

Google Chrome is a web browser developed by Google, primarily used for accessing the internet and running web applications. A vulnerability exists in Google Chrome related to memory references. This vulnerability stems from issues with memory references, and attackers can exploit it to achieve...

Google Chrome Bluetooth module memory error and reference vulnerability

Google Chrome is a cross-platform web browser developed by Google. It primarily provides features for web browsing, extension support, and tab management. Google Chrome has a memory error reference vulnerability, which stems from improper management of object lifetimes by the Bluetooth module,...

Google Chrome Skia integer overflow vulnerability (CNVD-2026-31527)

Google Chrome is a web browser developed by the American company Google. The Google Chrome Skia component has an integer overflow vulnerability, which allows attackers to execute arbitrary code on the system...

MTGPU of Moore Threading Technologies (Beijing) Co., Ltd. has a permission escalation vulnerability (CNVD-2026-22916).

Mole Thready Intelligence Technology Beijing Co., Ltd. is a company whose business involves the development of full-featured GPU chips and AI computing solutions, serving organizations in the field of digital transformation. Mole Thready Intelligence Technology Beijing Co., Ltd. has a permission...

Beijing Anbo Tong Technology Co., Ltd.'s next-generation firewall has a command execution vulnerability

Beijing Anbotong Technology Co., Ltd. referred to as “Anbotong” is committed to becoming a leader in building a secure computing power ecosystem in the AI era. Its independently developed ABT SPOS visual network security system platform has become a widely adopted network security suite by many...

IBM Db2 range partitioned tables denial-of-service vulnerability (CNVD-2026-23402)

IBM Db2 is a relational database management system developed by IBM. It is primarily used for data storage, querying, and analysis. IBM Db2 has a denial-of-service vulnerability that arises from improper handling of specially crafted queries involving range partition tables during execution...

IBM App Connect Enterprise log file information leakage vulnerability

IBM App Connect Enterprise is an application integration and enterprise messaging platform, primarily used for connecting different applications and data sources. IBM App Connect Enterprise has a vulnerability related to information leakage. This vulnerability stems from the program storing...

IBM Langflow OSS file processing component path traversal vulnerability

IBM Langflow OSS is an open-source low-code tool primarily used for building and deploying applications based on Large Language Models LLMs. IBM Langflow OSS has a path traversal vulnerability. This vulnerability stems from the failure to properly validate symbolic links during the decompression ...

IBM Aspera HSTS for CP4I certification bypass vulnerability

IBM Aspera HSTS for CP4I is a solution for high-speed and secure file transfer, primarily providing features for large-scale data transmission, encryption, and automated workflows. IBM Aspera HSTS for CP4I has a certification bypass vulnerability. This vulnerability arises due to the authenticati...

Changsha Metinfo Information Technology Co., Ltd. has a SQL injection vulnerability

MetInfo is an open-source CMS enterprise website building system that can be used for commercial websites without violating licensing agreements. Changsha Mitop Information Technology Co., Ltd.'s MetInfo has a SQL injection vulnerability, and attackers can exploit this vulnerability to access...

Microsoft UFO Shell Action Replay operating system command injection vulnerability

Microsoft UFO is an open-source framework used for intelligent automation across devices and platforms. Microsoft UFO has a vulnerability related to operating system command injection. This vulnerability stems from ShellReceiver.runshell, which fails to properly handle the action parameter. It...

MTGPU of Moore Threading Technologies (Beijing) Co., Ltd. has a permission escalation vulnerability (CNVD-2026-22915).

Mole Thready Intelligence Technology Beijing Co., Ltd. is a company whose business involves the development of full-featured GPU chips and AI computing solutions, serving organizations in the field of digital transformation. Mole Thready Intelligence Technology Beijing Co., Ltd. has a permission...

IBM Db2 Denial-of-Service Vulnerability (CNVD-2026-23403)

IBM Db2 is a relational database management system, primarily used for data storage, querying, and management. IBM Db2 has a denial-of-service vulnerability. This vulnerability arises from improper handling of specially crafted heap queries. Attackers can exploit this vulnerability to cause the...

IBM OPENBMC Denial-of-Service Vulnerability

IBM OpenBMC is an open-based board management controller firmware, primarily used for server hardware monitoring and management. IBM OpenBMC has a denial-of-service vulnerability. The vulnerability arises from the failure to properly validate requests from unauthenticated network users. Attackers...

ZTE ZXUniPOS NDS-LTE access control vulnerability

ZTE ZXUniPOS NDS-LTE is a modular baseband unit designed for wireless communication networks. It primarily provides multi-mode and multi-frequency signal processing as well as data aggregation functions. ZTE ZXUniPOS NDS-LTE has an access control vulnerability. This vulnerability arises from the...

Beijing YishengERP

Diankeyun ERP is an inventory management system developed using thinkPHP + LAYUI. Beijing Yisheng Internet Technology Co., Ltd.'s Diankeyun ERP has a directory traversal vulnerability, allowing attackers to obtain sensitive information through this vulnerability...

Beijing YishengERP

Diankeyun ERP is an inventory management system developed using thinkPHP and LAYUI. Beijing Yisheng Internet Technology Co., Ltd.'s Diankeyun ERP has logical defects and vulnerabilities. Attackers can exploit these vulnerabilities to add users...

TOTOLINK CA750-PoE: SetUploadUserData function vulnerability due to operating system command injection

The TOTOLINK CA750-PoE is a dual-band ceiling-mounted wireless access point from the TOTOLINK brand. It supports IEEE802.3af/at PoE power supply, with a maximum wireless rate of 750Mbps. It is designed for wireless coverage in scenarios such as hotels and shopping centers. The TOTOLINK CA750-PoE...

TOTOLINK CA750-PoE cstecgi.cgi file operating system command injection vulnerability

The TOTOLINK CA750-PoE is a dual-band ceiling-mounted wireless access point from the TOTOLINK brand. It supports IEEE802.3af/at PoE power supply, with a maximum wireless rate of 750Mbps. It is designed for wireless coverage in scenarios such as hotels and shopping centers. The TOTOLINK CA750-PoE...

Beijing YishengERPSQL

Diankeyun ERP is an inventory management system developed using thinkPHP and LAYUI. Beijing Yisheng Internet Technology Co., Ltd.'s Diankeyun ERP has a SQL injection vulnerability, allowing attackers to obtain sensitive database information...

TOTOLINK CA750-PoE Setting Handler component vulnerability due to operating system command injection

The TOTOLINK CA750-PoE is a dual-band ceiling-mounted wireless access point from the TOTOLINK brand. It supports IEEE802.3af/at PoE power supply, with a maximum wireless rate of 750Mbps. It is designed for wireless coverage in scenarios such as hotels and shopping centers. The TOTOLINK CA750-PoE...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32380)

TOTOLINK A8000RU is a wireless router produced by TOTOLINK, a Chinese company. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from an improper validation of the firewallType parameter in the setFirewallType function of the Web...

Google Chrome Override Read Vulnerability (CNVD-2026-29381)

Google Chrome is a web browser developed by Google Inc. of the United States. Google Chrome has a cross-origin data leakage vulnerability, allowing attackers to exploit this vulnerability to leak cross-origin data through specially crafted HTML pages...

TOTOLINK N300RH operating system command injection vulnerability

TOTOLINK N300RH is a 300Mbps single-band long-range wireless router launched by the TOTOLINK brand. It operates on the IEEE802.11n standard and is designed to enhance wireless coverage. TOTOLINK N300RH has a vulnerability related to operating system command injection. This vulnerability stems fro...

TOTOLINK CA750-PoE Setting component: Operating system command injection vulnerability

The TOTOLINK CA750-PoE is a dual-band ceiling-mounted wireless access point from the TOTOLINK brand. It supports IEEE802.3af/at PoE power supply, with a maximum wireless rate of 750Mbps. It is designed for wireless coverage in scenarios such as hotels and shopping centers. The TOTOLINK CA750-PoE...

TOTOLINK A8000RU operating system command injection vulnerability

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from an improper validation of the enable parameter in the setStaticDhcpRules function of the Web management...

ZTE MU5250 Access Control Vulnerability

The ZTE MU5250 is a 5G mobile Wi-Fi device produced by ZTE Corporation. The ZTE MU5250 has a vulnerability related to access control. This vulnerability stems from improper configuration of the access control mechanism. Attackers can exploit this vulnerability to obtain information without proper...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32388)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from the setIpQosRules function in the /cgi-bin/cstecgi.cgi file, which fails to properly validate the Comme...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32387)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from the setPasswordCfg function in the /cgi-bin/cstecgi.cgi file, which fails to properly validate the...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32385)

TOTOLINK A8000RU is a wireless router produced by TOTOLINK, a company from China. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from the setParentalRules function in the Web management interface’s /cgi-bin/cstecgi.cgi file, which...

TOTOLINK CA750-PoE: SetUnloadUserData function vulnerability due to operating system command injection

The TOTOLINK CA750-PoE is a dual-band ceiling-mounted wireless access point from the TOTOLINK brand. It supports IEEE802.3af/at PoE power supply, with a maximum wireless rate of 750Mbps. It is designed for wireless coverage in scenarios such as hotels and shopping centers. The TOTOLINK CA750-PoE...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32397)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from the cstecgi.cgi file in the web management interface, where the setWiFiAdvancedCfg function fails to...

TOTOLINK CA750-PoE setWebWlanIdx function: Operating system command injection vulnerability

The TOTOLINK CA750-PoE is a dual-band ceiling-mounted wireless access point from the TOTOLINK brand. It supports IEEE802.3af/at PoE power supply and has a maximum wireless rate of 750Mbps. It is designed for wireless coverage in scenarios such as hotels and shopping centers. The TOTOLINK CA750-Po...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32389)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from the setWanCfg function in the cstecgi.cgi file of the Web management interface component, which fails t...