Microsoft Office Exploitation Vulnerability (CNVD-2026-23631)

Microsoft Office is a suite of office software products developed by the American company Microsoft. Common components of this product include Word, Excel, Access, PowerPoint, and FrontPage. Microsoft Office has a deception vulnerability that attackers can exploit to carry out deceptive attacks...

Microsoft M365 Copilot for Desktop has a deception vulnerability

Microsoft M365 Copilot is an AI-driven productivity tool developed by the American company Microsoft. Microsoft M365 Copilot for Desktop has a deception vulnerability, and attackers can exploit this vulnerability to carry out deceptive attacks...

Mozilla Firefox has an unknown vulnerability (CNVD-2026-23639)

Mozilla Firefox is an open-source web browser developed by the Mozilla Foundation in the United States. There are security vulnerabilities in Mozilla Firefox, which stem from issues with the JavaScript Engine component. Currently, no detailed information about these vulnerabilities is available...

Microsoft SharePoint code vulnerability (CNVD-2026-26520)

Microsoft SharePoint is a corporate business collaboration platform developed by Microsoft Corporation in the United States. This platform is used for integrating business information and enabling sharing of work, collaboration with others, organization of projects and teams, as well as searching...

Microsoft Office Code Execution Vulnerability (CNVD-2026-23632)

Microsoft Office is a suite of office software products developed by Microsoft Corporation in the United States. Common components of this product include Word, Excel, Access, PowerPoint, and FrontPage. Microsoft Office has a code execution vulnerability, which allows attackers to execute arbitra...

Mozilla Firefox has an unknown vulnerability (CNVD-2026-23640)

Mozilla Firefox is an open-source web browser developed by the Mozilla Foundation in the United States. There is a security vulnerability in Mozilla Firefox, which stems from a sandbox escape in the Profile Backup component. Currently, no detailed details about this vulnerability are available...

Microsoft Data Formulator code injection vulnerability

Microsoft Data Formulator is an AI data visualization and analysis tool developed by Microsoft Corporation in the United States, powered by large language models. There is a security vulnerability in Microsoft Data Formulator. Attackers can exploit this vulnerability to execute code remotely...

Microsoft SharePoint code vulnerability (CNVD-2026-26519)

Microsoft SharePoint is a corporate business collaboration platform developed by Microsoft Corporation in the United States. This platform is used for integrating business information and enabling sharing of work, collaboration with others, organization of projects and teams, as well as searching...

Mozilla Firefox Code Execution Vulnerability (CNVD-2026-23637)

Mozilla Firefox is an open-source web browser developed by the Mozilla Foundation in the United States. Mozilla Firefox has a code execution vulnerability, which stems from errors in the JavaScript Engine’s JIT compilation process. Attackers can exploit this vulnerability to execute arbitrary cod...

Mozilla Firefox Memory Error Reference Vulnerability (CNVD-2026-23638)

Mozilla Firefox is an open-source web browser developed by the Mozilla Foundation in the United States. Mozilla Firefox has a memory corruption vulnerability, which stems from JavaScript: the WebAssembly component responsible for releasing memory experiences confusion in its instructions. Attacke...

uBidAuction cross-site scripting vulnerability (CNVD-2026-31517)

uBidAuction is an auction website system developed by the uBidAuction company, which supports online auctions and product transaction management. uBidAuction has a cross-site scripting vulnerability. This vulnerability arises due to the incorrect handling of the datecreated, datefrom, dateto, and...

uBidAuction cross-site scripting vulnerability (CNVD-2026-26093)

uBidAuction is an auction website system operated by the uBidAuction company, which supports online auctions and product transaction management. uBidAuction has a cross-site scripting vulnerability. This vulnerability arises due to the incorrect handling of the datecreated, datefrom, dateto, and...

uBidAuction cross-site scripting vulnerability (CNVD-2026-29379)

uBidAuction is an auction website system developed by the uBidAuction company, which supports online auctions and product transaction management. uBidAuction has a cross-site scripting vulnerability. This vulnerability arises due to the incorrect handling of the datecreated, datefrom, dateto, and...

uBidAuction cross-site scripting vulnerability (CNVD-2026-29380)

uBidAuction is an auction website system operated by the uBidAuction company, which supports online auctions and product transaction management. uBidAuction has a cross-site scripting vulnerability. This vulnerability arises due to the incorrect handling of the datecreated, datefrom, dateto, and...

Multiple Apple products have service denial vulnerabilities (CNVD-2026-26102)

Apple iOS, among others, are products of the American company Apple. Apple iOS is an operating system developed for mobile devices. Apple tvOS is an operating system for smart TVs. Apple watchOS is an operating system for smart watches. Several Apple products have service denial vulnerabilities;...

D-Link DNS-320 Operating System Command Injection Vulnerability (CNVD-2026-32583)

The D-Link DNS-320 is a dual-disk entry-level NAS network storage device launched by D-Link. The D-Link DNS-320 has an operating system command injection vulnerability. This vulnerability stems from multiple functions in the file/cgi-bin/networkmgr.cgi failing to properly validate user input...

D-Link DNS-320 operating system command injection vulnerability

The D-Link DNS-320 is a dual-disk entry-level NAS network storage device launched by D-Link. The D-Link DNS-320 has an operating system command injection vulnerability. This vulnerability stems from the chown function in webfilemgr.cgi, which fails to properly filter user input. Currently, no...

D-Link DCS-935L buffer overflow vulnerability

The D-Link DCS-935L is a network camera designed for home and small office environments. By default, it provides device configuration options through a CGI interface. The D-Link DCS-935L has a buffer overflow vulnerability. This vulnerability stems from the SetDeviceSettings function in the HNAP...

Apple iOS and Apple iPadOS denial-of-service vulnerabilities

Apple iOS is an operating system developed for mobile devices. Apple iPadOS is an operating system for iPad tablets. Both Apple iOS and Apple iPadOS have denial-of-service vulnerabilities, and attackers can exploit these vulnerabilities to cause denial of service...

Apple iOS and Apple iPadOS security bypass vulnerabilities

Apple iOS is an operating system developed for mobile devices. Apple iPadOS is an operating system for iPad tablets. Both Apple iOS and Apple iPadOS have security vulnerabilities that allow attackers to bypass application privacy report logging mechanisms...

D-Link DCS-932L command injection vulnerability

The D-Link DCS-932L is a home-use infrared wireless network camera launched by D-Link in 2012. The D-Link DCS-932L has a command injection vulnerability. This vulnerability stems from the sub42EF14 function in the /bin/alphapd file, which fails to properly handle the LightSensorControl parameter...

Linux kernel sco_sock_connect function memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A memory misreference vulnerability exists in the Linux kernel. The vulnerability stems from a confusion in the instruction responsible for freeing memory in the scosockconnect...

D-Link M60 License Issue Vulnerability

The D-Link M60 is a wireless routing device from China-based D-Link. An authorization issue vulnerability exists in D-Link M60 version 1.20B02 and prior versions, which stems from a weak password recovery issue in the file /usr/bin/httpd, and can be exploited by an attacker to cause...

The TOTOLINK N300RH file contains a vulnerability

TOTOLINK N300RH is a 300Mbps single-band long-range wireless router launched by the TOTOLINK brand. It operates on the IEEE802.11n standard and is designed to enhance wireless coverage. TOTOLINK N300RH has a vulnerability in its software. This vulnerability stems from the setUploadSetting functio...

Linux kernel set_cig_params_sync function memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A memory misreference vulnerability exists in the Linux kernel. The vulnerability stems from the setcigparamssync function in Bluetooth hciconn not locking hciconn, which can b...

Linux kernel smb_check_perm_dacl function out-of-bounds read vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from an out-of-bounds read vulnerability. The vulnerability stems from insufficient ACE size validation in the smbcheckpermdacl function of ksmbd, whic...

Linux kernel fuse_add_dirent_to_cache function buffer overflow vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A buffer overflow vulnerability exists in the Linux kernel. The vulnerability stems from the fuseadddirenttocache function not checking if the dirent size exceeds PAGESIZE, whi...

Linux kernel x25_queue_rx_frame function memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A memory misreference vulnerability exists in the Linux kernel. The vulnerability stems from a call to kfreeskb when allocskb fails in x25queuerxframe, which can be exploited b...

Linux kernel netfilter nf_conntrack_helper function memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A memory misreference vulnerability exists in the Linux kernel. The vulnerability stems from passing a NULL pointer when expecting cleanup in netfilter nfconntrackhelper, which...

IBM Watsonx.Data intelligence information leakage vulnerability

IBM Watsonx.Data Intelligence is a data intelligence platform developed by IBM. There is an information leakage vulnerability in IBM Watsonx.Data Intelligence. This vulnerability stems from storing user credentials in plain text, allowing attackers to exploit it to obtain sensitive information...

Linux Kernel wilc1000 Integer Overflow Vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates from a heap buffer overflow due to a u8 overflow in the wilc1000 wireless driver, which could lead to memory...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32568)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from an unknown function in the CGI Handler component file /cgi-bin/cstecgi.cgi, which manipulates the...

OpenClaw Server-Side Request Forgery Vulnerability

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a server-side request forgery vulnerability that stems from a server-side request forgery vulnerability in QQBot direct media uploads that skips URL authentication. An attacker can exploit this...

Cisco IoT Field Network Director command injection vulnerability

The Cisco IoT Field Network Director IoT-FND is a product used for managing IoT networks. It primarily provides features for remote device monitoring, configuration, and troubleshooting. The Cisco IoT Field Network Director has a command injection vulnerability. This vulnerability arises due to t...

Cisco IoT Field Network Director path traversal vulnerability

The Cisco IoT Field Network Director IoT-FND is a centralized management platform used to manage Cisco IoT networks. It primarily provides functions such as device configuration, monitoring, firmware updates, and troubleshooting. The Cisco IoT Field Network Director has a path traversal...

OpenClaw has an unspecified vulnerability (CNVD-2026-19640)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a security vulnerability that can be exploited by an attacker to bypass permission list validation by embedding shell extension tokens in heredoc bodies to execute unapproved commands at runtime...

Cisco Enterprise Chat and Email cross-site scripting vulnerabilities

Cisco Enterprise Chat and Email is an enterprise-level chat and email communication platform that primarily provides real-time chat, email management, and customer interaction features. Cisco Enterprise Chat and Email has a cross-site scripting vulnerability. This vulnerability stems from...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32569)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics Corporation. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from the function setUrlFilterRules in the CGI Handler component’s file /cgi-bin/cstecgi.cgi,...

Google Chrome Network Integer Overflow Vulnerability

Google Chrome is a web browser developed by Google to provide web browsing, application running and internet communication features. Google Chrome suffers from an integer overflow vulnerability that stems from the Network component failing to properly handle certain data, which can be exploited b...

OpenClaw server-side request forgery vulnerability (CNVD-2026-19639)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a server-side request forgery vulnerability that can be exploited by an attacker to gain unauthorized access to internal resources by providing a malicious photo URL to the Zalo Bot API to bypass SSRF...

OpenClaw has an unspecified vulnerability (CNVD-2026-19618)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a security vulnerability that stems from the derivation of a loopback MCP owner context from a server-issued bearer token that can be spoofed in the request header, which can be exploited by an attacke...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32570)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from the function setWiFiWpsStart in the CGI Handler component’s file /cgi-bin/cstecgi.cgi. This function...

XATABoost CMS SQL Injection Vulnerability

XATABoost CMS is a content management system from XATABoost that provides website content publishing and management functions. A SQL injection vulnerability exists in XATABoost CMS version 1.0.0. The vulnerability stems from the application's lack of validation of externally entered SQL statement...

OpenClaw has an unspecified vulnerability (CNVD-2026-20009)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a security vulnerability that stems from the failure of the OpenShell file system bridge to properly validate symbolic link exchanges when handling file system operations, which can be exploited by an...

OpenClaw has an unspecified vulnerability (CNVD-2026-20008)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a security vulnerability that stems from a failure to properly preserve the OPENCLAWRuntime Control Environment namespace in the workspace dotenv file, which can be exploited by an attacker to manipula...

FluentCMS TextHTML Plugin Cross-Site Scripting Vulnerability

FluentCMS is a .NET-based content management system CMS that is primarily used to quickly build websites and manage web content. A cross-site scripting vulnerability exists in the FluentCMS TextHTML plugin. The vulnerability stems from insufficient validation of user input and failure to properly...

IBM Langflow Desktop path traversal vulnerability

IBM Langflow Desktop is a graphical-based AI workflow development tool, primarily used for building and deploying AI applications. IBM Langflow Desktop has a path traversal vulnerability. This vulnerability stems from an improper handling of the "..." sequence in URL requests. An attacker can...

TOTOLINK WA300 buffer overflow vulnerability

TOTOLINK WA300 is a 300Mbps single-band 2.4GHz wired wireless AP access point designed for installation in standard 86-type enclosures. It is primarily used for wireless coverage in hotels, dormitories, and office environments. The TOTOLINK WA300 has a buffer overflow vulnerability. This...

D-Link DI-8100 buffer overflow vulnerability (CNVD-2026-32589)

The D-Link DI-8100 is a wired network behavior management router designed by D-Link for small and medium-sized businesses. The D-Link DI-8100 has a buffer overflow vulnerability, which stems from a function in the file/urlrule.asp called urlruleasp failing to correctly validate the input length...

TOTOLINK N300RH buffer overflow vulnerability (CNVD-2026-32746)

TOTOLINK N300RH is a 300Mbps single-band long-range wireless router launched by the TOTOLINK brand. It operates on the IEEE802.11n standard and is designed to enhance wireless coverage. The TOTOLINK N300RH has a buffer overflow vulnerability. This vulnerability stems from the setUpgradeFW functio...