Siemens RUGGEDCOM ROX parameter injection vulnerability

Siemens RUGGEDCOM ROX is a dedicated operating system developed by Siemens for its industrial communication devices. It primarily runs on RUGGEDCOM series of industrial Ethernet switches, routers, and multi-service platforms. Siemens RUGGEDCOM ROX has a parameter injection vulnerability; this...

Siemens SIMATIC HMI Comfort Panels have undisclosed vulnerabilities

Siemens SIMATIC HMI Comfort Panels are touchscreen devices produced by the German company Siemens. Siemens SIMATIC HMI Comfort Panels have security vulnerabilities. These vulnerabilities stem from improper restrictions on access to web browsers through the control panel. Unauthorized attackers ca...

Siemens Solid Edge buffer overflow vulnerability (CNVD-2026-23467)

Siemens Solid Edge is a 3D CAD software developed by the German company Siemens. This software can be used for part design, assembly design, sheet metal design, welding design, and other industries. Siemens Solid Edge has a buffer overflow vulnerability; this vulnerability stems from the lack of...

Siemens Solid Edge stack buffer overflow vulnerability (CNVD-2026-23468)

Siemens Solid Edge is a 3D CAD software developed by the German company Siemens. This software can be used for parts design, assembly design, sheet metal design, welding design, and other industries. Siemens Solid Edge has a stack buffer overflow vulnerability, which allows attackers to execute...

CouchCMS cross-site scripting vulnerability

CouchCMS is an open-source content management system CMS designed for designers. Version 2.2.1 of CouchCMS contains a cross-site scripting vulnerability. This vulnerability stems from the application’s lack of effective filtering and escaping of data provided by users. Attackers can exploit this...

Fortinet FortiAuthenticator Access Control Vulnerability (CNVD-2026-25590)

Fortinet FortiAuthenticator is a centralized user identity management solution provided by the American company Fortinet. There is an access control vulnerability in Fortinet FortiAuthenticator. This vulnerability stems from improper access control; attackers can exploit this vulnerability to...

BloofoxCMS Cross-Site Request Forgery Vulnerability

BloofoxCMS is a PHP-based text content management system. The bloofoxCMS 0.5.2.1 version has a cross-site request forgeing vulnerability. This vulnerability arises from the WEB application not properly verifying whether the request comes from a trusted user. Attackers can exploit this vulnerabili...

Siemens Teamcenter Trust Management Vulnerability

Siemens Teamcenter is a software application for product lifecycle management developed by the German company Siemens. Siemens Teamcenter has a vulnerability related to trust management. This vulnerability stems from the use of hardcoded keys for obfuscation. Attackers can exploit this...

Zyxel WRE6505 operating system command injection vulnerability

The Zyxel WRE6505 is a wireless signal expansion device produced by the Chinese company Zyxel. The Zyxel WRE6505 has an operating system command injection vulnerability. This vulnerability arises from the CGI program’s failure to properly filter special characters and commands constructed in...

Fortinet FortiAP operating system command injection vulnerability (CNVD-2026-25589)

Fortinet FortiAP is a controller developed by the American company Fortinet, used for managing wireless access point devices. There are vulnerabilities related to operating system command injection in Fortinet FortiAP and FortiAP-W2. These vulnerabilities stem from improper neutralization of...

Textpattern CMS file upload vulnerability

Textpattern CMS is a content management system based on PHP. Version 4.8.7 of Textpattern CMS has a file upload vulnerability. This vulnerability arises from the lack of strict validation or filtering during file uploads by users. Attackers can exploit this vulnerability to execute arbitrary...

Microsoft M365 Copilot for Desktop has a deception vulnerability

Microsoft M365 Copilot is an AI-driven productivity tool developed by the American company Microsoft. Microsoft M365 Copilot for Desktop has a deception vulnerability, and attackers can exploit this vulnerability to carry out deceptive attacks...

Microsoft Office Exploitation Vulnerability (CNVD-2026-23631)

Microsoft Office is a suite of office software products developed by the American company Microsoft. Common components of this product include Word, Excel, Access, PowerPoint, and FrontPage. Microsoft Office has a deception vulnerability that attackers can exploit to carry out deceptive attacks...

Mozilla Firefox has an unknown vulnerability (CNVD-2026-23639)

Mozilla Firefox is an open-source web browser developed by the Mozilla Foundation in the United States. There are security vulnerabilities in Mozilla Firefox, which stem from issues with the JavaScript Engine component. Currently, no detailed information about these vulnerabilities is available...

Microsoft Office Code Execution Vulnerability (CNVD-2026-23632)

Microsoft Office is a suite of office software products developed by Microsoft Corporation in the United States. Common components of this product include Word, Excel, Access, PowerPoint, and FrontPage. Microsoft Office has a code execution vulnerability, which allows attackers to execute arbitra...

Microsoft SharePoint code vulnerability (CNVD-2026-26520)

Microsoft SharePoint is a corporate business collaboration platform developed by Microsoft Corporation in the United States. This platform is used for integrating business information and enabling sharing of work, collaboration with others, organization of projects and teams, as well as searching...

Mozilla Firefox has an unknown vulnerability (CNVD-2026-23640)

Mozilla Firefox is an open-source web browser developed by the Mozilla Foundation in the United States. There is a security vulnerability in Mozilla Firefox, which stems from a sandbox escape in the Profile Backup component. Currently, no detailed details about this vulnerability are available...

Mozilla Firefox Memory Error Reference Vulnerability (CNVD-2026-23638)

Mozilla Firefox is an open-source web browser developed by the Mozilla Foundation in the United States. Mozilla Firefox has a memory corruption vulnerability, which stems from JavaScript: the WebAssembly component responsible for releasing memory experiences confusion in its instructions. Attacke...

Mozilla Firefox Code Execution Vulnerability (CNVD-2026-23637)

Mozilla Firefox is an open-source web browser developed by the Mozilla Foundation in the United States. Mozilla Firefox has a code execution vulnerability, which stems from errors in the JavaScript Engine’s JIT compilation process. Attackers can exploit this vulnerability to execute arbitrary cod...

Microsoft Data Formulator code injection vulnerability

Microsoft Data Formulator is an AI data visualization and analysis tool developed by Microsoft Corporation in the United States, powered by large language models. There is a security vulnerability in Microsoft Data Formulator. Attackers can exploit this vulnerability to execute code remotely...

Microsoft SharePoint code vulnerability (CNVD-2026-26519)

Microsoft SharePoint is a corporate business collaboration platform developed by Microsoft Corporation in the United States. This platform is used for integrating business information and enabling sharing of work, collaboration with others, organization of projects and teams, as well as searching...

uBidAuction cross-site scripting vulnerability (CNVD-2026-26093)

uBidAuction is an auction website system operated by the uBidAuction company, which supports online auctions and product transaction management. uBidAuction has a cross-site scripting vulnerability. This vulnerability arises due to the incorrect handling of the datecreated, datefrom, dateto, and...

uBidAuction cross-site scripting vulnerability (CNVD-2026-31517)

uBidAuction is an auction website system developed by the uBidAuction company, which supports online auctions and product transaction management. uBidAuction has a cross-site scripting vulnerability. This vulnerability arises due to the incorrect handling of the datecreated, datefrom, dateto, and...

uBidAuction cross-site scripting vulnerability (CNVD-2026-29379)

uBidAuction is an auction website system developed by the uBidAuction company, which supports online auctions and product transaction management. uBidAuction has a cross-site scripting vulnerability. This vulnerability arises due to the incorrect handling of the datecreated, datefrom, dateto, and...

uBidAuction cross-site scripting vulnerability (CNVD-2026-29380)

uBidAuction is an auction website system operated by the uBidAuction company, which supports online auctions and product transaction management. uBidAuction has a cross-site scripting vulnerability. This vulnerability arises due to the incorrect handling of the datecreated, datefrom, dateto, and...

Tenda AC6 operating system command injection vulnerability (CNVD-2026-38720)

The Tenda AC6 is a dual-band gigabit wireless router launched by Tenda. The Tenda AC6 has a vulnerability related to operating system command injection. This vulnerability stems from an unknown function in the httpd component, specifically the file/goform/telnet, which manipulates the parameter...

D-Link DNS-320 Operating System Command Injection Vulnerability (CNVD-2026-32583)

The D-Link DNS-320 is a dual-disk entry-level NAS network storage device launched by D-Link. The D-Link DNS-320 has an operating system command injection vulnerability. This vulnerability stems from multiple functions in the file/cgi-bin/networkmgr.cgi failing to properly validate user input...

D-Link DNS-320 operating system command injection vulnerability

The D-Link DNS-320 is a dual-disk entry-level NAS network storage device launched by D-Link. The D-Link DNS-320 has an operating system command injection vulnerability. This vulnerability stems from the chown function in webfilemgr.cgi, which fails to properly filter user input. Currently, no...

Multiple Apple products have service denial vulnerabilities (CNVD-2026-26102)

Apple iOS, among others, are products of the American company Apple. Apple iOS is an operating system developed for mobile devices. Apple tvOS is an operating system for smart TVs. Apple watchOS is an operating system for smart watches. Several Apple products have service denial vulnerabilities;...

Tenda AC6 operating system command injection vulnerability (CNVD-2026-38719)

The Tenda AC6 is a dual-band gigabit wireless router launched by Tenda. The Tenda AC6 has a vulnerability related to operating system command injection. This vulnerability stems from the fromSetWirelessRepeat function in the httpd component’s goform/WifiExtraSet module, which processes parameters...

Apple iOS and Apple iPadOS denial-of-service vulnerabilities

Apple iOS is an operating system developed for mobile devices. Apple iPadOS is an operating system for iPad tablets. Both Apple iOS and Apple iPadOS have denial-of-service vulnerabilities, and attackers can exploit these vulnerabilities to cause denial of service...

D-Link DCS-935L buffer overflow vulnerability

The D-Link DCS-935L is a network camera designed for home and small office environments. By default, it provides device configuration options through a CGI interface. The D-Link DCS-935L has a buffer overflow vulnerability. This vulnerability stems from the SetDeviceSettings function in the HNAP...

Tenda AC6 operating system command injection vulnerability

The Tenda AC6 is a dual-band gigabit wireless router launched by Tenda. The Tenda AC6 has a vulnerability related to operating system command injection. This vulnerability stems from the getlogfile function in the httpd component, which processes the wans.flag parameter. Currently, no detailed...

Tenda AC6 operating system command injection vulnerability (CNVD-2026-38718)

The Tenda AC6 is a dual-band gigabit wireless router launched by Tenda. The Tenda AC6 has a vulnerability related to operating system command injection. This vulnerability stems from the formWifiApScan function in the httpd component’s/goform/WifiApScan file, which fails to properly validate the...

Apple iOS and Apple iPadOS security bypass vulnerabilities

Apple iOS is an operating system developed for mobile devices. Apple iPadOS is an operating system for iPad tablets. Both Apple iOS and Apple iPadOS have security vulnerabilities that allow attackers to bypass application privacy report logging mechanisms...

D-Link DCS-932L command injection vulnerability

The D-Link DCS-932L is a home-use infrared wireless network camera launched by D-Link in 2012. The D-Link DCS-932L has a command injection vulnerability. This vulnerability stems from the sub42EF14 function in the /bin/alphapd file, which fails to properly handle the LightSensorControl parameter...

SQL Injection Vulnerability in Pharmacy Sales and Inventory System (CNVD-2026-37997)

The Pharmacy Sales and Inventory System is a pharmacy sales and inventory management system developed by SourceCodester. The Pharmacy Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the lack of validation for external SQL statements in the parameter ID...

Linux kernel sco_sock_connect function memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A memory misreference vulnerability exists in the Linux kernel. The vulnerability stems from a confusion in the instruction responsible for freeing memory in the scosockconnect...

Linux kernel set_cig_params_sync function memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A memory misreference vulnerability exists in the Linux kernel. The vulnerability stems from the setcigparamssync function in Bluetooth hciconn not locking hciconn, which can b...

D-Link M60 License Issue Vulnerability

The D-Link M60 is a wireless routing device from China-based D-Link. An authorization issue vulnerability exists in D-Link M60 version 1.20B02 and prior versions, which stems from a weak password recovery issue in the file /usr/bin/httpd, and can be exploited by an attacker to cause...

The TOTOLINK N300RH file contains a vulnerability

TOTOLINK N300RH is a 300Mbps single-band long-range wireless router launched by the TOTOLINK brand. It operates on the IEEE802.11n standard and is designed to enhance wireless coverage. TOTOLINK N300RH has a vulnerability in its software. This vulnerability stems from the setUploadSetting functio...

SQL Injection Vulnerability in Pharmacy Sales and Inventory System

The Pharmacy Sales and Inventory System is a pharmacy sales and inventory management system developed by SourceCodester. The Pharmacy Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the lack of validation for external SQL statements in the parameter ID...

Linux kernel fuse_add_dirent_to_cache function buffer overflow vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A buffer overflow vulnerability exists in the Linux kernel. The vulnerability stems from the fuseadddirenttocache function not checking if the dirent size exceeds PAGESIZE, whi...

Linux kernel netfilter nf_conntrack_helper function memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A memory misreference vulnerability exists in the Linux kernel. The vulnerability stems from passing a NULL pointer when expecting cleanup in netfilter nfconntrackhelper, which...

Linux kernel smb_check_perm_dacl function out-of-bounds read vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from an out-of-bounds read vulnerability. The vulnerability stems from insufficient ACE size validation in the smbcheckpermdacl function of ksmbd, whic...

Linux kernel x25_queue_rx_frame function memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A memory misreference vulnerability exists in the Linux kernel. The vulnerability stems from a call to kfreeskb when allocskb fails in x25queuerxframe, which can be exploited b...

IBM Watsonx.Data intelligence information leakage vulnerability

IBM Watsonx.Data Intelligence is a data intelligence platform developed by IBM. There is an information leakage vulnerability in IBM Watsonx.Data Intelligence. This vulnerability stems from storing user credentials in plain text, allowing attackers to exploit it to obtain sensitive information...

Pharmacy Sales and Inventory System Cross-site Scripting Vulnerability (CNVD-2026-37998)

The Pharmacy Sales and Inventory System is a pharmacy sales and inventory management system developed by SourceCodester Corporation. The Pharmacy Sales and Inventory System has a cross-site scripting vulnerability. This vulnerability arises from the failure of the /index.php?page=users file to...

Linux Kernel wilc1000 Integer Overflow Vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates from a heap buffer overflow due to a u8 overflow in the wilc1000 wireless driver, which could lead to memory...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32568)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from an unknown function in the CGI Handler component file /cgi-bin/cstecgi.cgi, which manipulates the...