Apache Fury deserialization vulnerability (CNVD-2026-30659)

Apache Fury is a high-performance serialization framework that supports multiple languages such as Java and C++. It is widely used in distributed systems and message queues to handle cross-language or cross-process data exchanges. Before version 1.4.0, Apache Fury had a deserialization...

Apache Syncope Server Request Forgery Vulnerability (CNVD-2026-30661)

Apache Syncope is an open-source identity management system, primarily used for managing the identity lifecycle and access control of enterprise users. There are security vulnerabilities in Apache Syncope. These vulnerabilities stem from the failure to properly validate user inputs during...

Google Chrome Resource Management Error Vulnerability (CNVD-2026-30671)

Chrome is a web browser developed by Google. Google Chrome has a security vulnerability, which stems from an issue with the CameraCapture module that allows for reuse after release. Attackers can exploit this vulnerability to achieve sandbox escape through specially crafted HTML pages...

Google Chrome Resource Management Error Vulnerability (CNVD-2026-30670)

Chrome is a web browser developed by Google. Google Chrome has a security vulnerability, which stems from a memory leak present in its network components. Attackers can exploit this vulnerability to cause heap corruption through specially crafted HTML pages...

Mozilla Firefox ESR buffer overflow vulnerability (CNVD-2026-31197)

Mozilla Firefox ESR is an extended support version of Firefox a web browser open-sourced by the Mozilla Foundation. Mozilla Firefox ESR has a buffer overflow vulnerability. This vulnerability stems from a memory security flaw; attackers can exploit this vulnerability to cause memory corruption,...

Google Chrome Resource Management Error Vulnerability (CNVD-2026-30672)

Chrome is a web browser developed by Google. Google Chrome has a resource management vulnerability, which stems from issues with reusing resources after they have been released in the Ozone component. Attackers can exploit this vulnerability by inducing specific UI gestures on users’ devices,...

Google Chrome Resource Management Error Vulnerability (CNVD-2026-30675)

Google Chrome is a cross-platform web browser developed by Google Inc. of the United States. There are security vulnerabilities in Google Chrome. Attackers can exploit these vulnerabilities by using specially crafted HTML pages to induce users to perform certain UI gestures, thereby exploiting he...

Google Chrome Resource Management Error Vulnerability (CNVD-2026-30669)

Chrome is a web browser developed by Google. Google Chrome has a security vulnerability, which stems from a memory leak present in the Cast module. Attackers can exploit this vulnerability to execute arbitrary code within the sandbox through carefully crafted HTML pages...

Google Chrome buffer overflow vulnerability (CNVD-2026-30673)

Chrome is a web browser developed by Google. Google Chrome has a security vulnerability, which stems from a boundary error in the V8 module. Attackers can exploit this vulnerability to execute arbitrary code within the sandbox through specially crafted HTML pages...

Google Chrome Resource Management Error Vulnerability (CNVD-2026-30674)

Chrome is a web browser developed by Google. Google Chrome has a security vulnerability, which stems from a flaw in the GPU module that allows for reuse after release. Attackers can exploit this vulnerability to bypass sandbox protections through specially crafted HTML pages...

OpenClaw resource management error vulnerability

OpenClaw is an intelligent artificial assistant open-sourced by the OpenClaw team. OpenClaw has a resource management vulnerability that stems from remote media URLs, which can trigger slow read attacks. Attackers can exploit this vulnerability by providing remote media URLs through configured...

Tenda AC10 buffer overflow vulnerability

The Tenda AC10 is a wireless router device produced by the Chinese company Tenda. The Tenda AC10 has a buffer overflow vulnerability. This vulnerability stems from a function in the httpd/netctrl component called fromAdvSetLanip, which handles operations on the GetValue/SetValue parameters, leadi...

Hikvision DS-2 series camera information leakage vulnerability

Hikvision DS-2 series cameras are part of the Hikvision camera lineup. The Hikvision DS-2 series cameras have a vulnerability where information can be leaked. Attackers can exploit this vulnerability to access certain information stored in the device’s memory...

ASUS Router Command Injection Vulnerability (CNVD-2026-30681)

ASUS Router is the router firmware and management system from ASUS, used for network connection configuration and device management. The ASUS Router has a command injection vulnerability. This vulnerability arises due to improper validation of the integrity check value and certificate verificatio...

Hikvision NVR/DVR Device buffer overflow vulnerabilities

Hikvision NVR/DVR devices are a series of network cameras produced by Hikvision, a company from China. Hikvision NVR/DVR devices have a buffer overflow vulnerability. Attackers can exploit this vulnerability to send specific messages within a local area network, causing the devices to malfunction...

Hikvision DS-2 series camera buffer overflow vulnerability

Hikvision DS-2 series cameras are part of the Hikvision camera lineup. The Hikvision DS-2 series cameras have a buffer overflow vulnerability. Attackers can exploit this vulnerability by sending specific messages, which may cause the devices to malfunction...

Siemens COMOS permission licensing and access control vulnerabilities

Siemens Comos is a factory engineering software solution developed by the German company Siemens. Siemens COMOS has vulnerabilities related to permission licensing and access control. These vulnerabilities stem from an insecure search path within the IAM Client SDK. Attackers can exploit these...

IBM Langflow OSS code injection vulnerability (CNVD-2026-31204)

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...

IBM Langflow OSS path traversal vulnerability (CNVD-2026-31206)

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...

IBM Langflow OSS code injection vulnerability (CNVD-2026-31205)

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...

TP-Link Archer VX1800v v1 domain name parameter injection vulnerability

The Archer VX1800v v1 is a dual-band Gigabit wireless router produced by TP-Link. The TP-Link Archer VX1800v v1 has a command injection vulnerability. This vulnerability stems from improper cleaning of domain name parameters. Attackers can exploit this vulnerability by accessing relevant HTTP...

NVIDIA Triton Inference Server resource management error vulnerability

NVIDIA Triton Inference Server is an open-source AI model inference service system developed by NVIDIA Corporation in the United States. There is a resource management vulnerability in NVIDIA Triton Inference Server. This vulnerability stems from the failure to release memory after the lifecycle...

TP-Link Archer VX1800v v1: TR-069/CWMP management interface command injection vulnerability

The TP-Link Archer VX1800v v1 is a dual-band Gigabit wireless router manufactured by TP-Link Systems Inc. The TP-Link Archer VX1800v v1, with version 0.16.0 2.0.0 v6092.0 Build 260521 RC.7927n, had a command injection vulnerability in earlier versions. This vulnerability stemmed from insufficient...

Hikvision HikCentral FocSign has an unknown vulnerability (CNVD-2026-28547).

Hikvision HikCentral FocSign is a software developed by Hikvision, a company in China, that integrates functions such as information display, facial attendance, and passenger flow statistics. There is a security vulnerability in Hikvision HikCentral FocSign, which stems from an unreferenced servi...

Microsoft .NET Framework Denial-of-Service Vulnerability (CNVD-2026-28483)

Microsoft .NET Framework is a comprehensive and consistent programming model developed by Microsoft Corporation in the United States. It is also a development platform used to build applications for Windows, Windows Store, Windows Phone, Windows Server, and Microsoft Azure. This platform includes...

Hikvision HikCentral Professional has an unknown vulnerability (CNVD-2026-28554)

Hikvision HikCentral Professional is a professional edition of the AI Cloud-based application management platform designed for edge domains by Hikvision, a Chinese company. Hikvision HikCentral Professional has a security vulnerability that stems from access control issues. Attackers can exploit...

Microsoft ASP.NET Core privilege escalation vulnerability (CNVD-2026-28484)

Microsoft ASP.NET Core is a cross-platform open-source framework developed by Microsoft. This framework is used to build cloud-based applications such as web applications, IoT applications, and mobile backends. There is a permission escalation vulnerability in Microsoft ASP.NET Core, which allows...

Huawei HarmonyOS Buffer Overflow Vulnerability (CNVD-2026-29729)

Huawei HarmonyOS is a distributed operating system developed by Huawei for various scenarios. Version 6.1.0 of Huawei HarmonyOS contains a buffer overflow vulnerability. This vulnerability arises from failing to correctly validate the input range when reading image data, resulting in the reading ...

Huawei HarmonyOS Image Codec Module Out-of-Bounds Read Vulnerability

Huawei HarmonyOS is an operating system developed by Chinese company Huawei. It is a full-scenario distributed operating system based on a microkernel architecture. The Huawei HarmonyOS’s media coding and decoding module contains a out-of-bounds read vulnerability, which allows attackers to...

Huawei HarmonyOS Image Codec Module Out-of-Bounds Reading Vulnerability

Huawei HarmonyOS is an operating system. The image codec module of Huawei HarmonyOS has a out-of-bounds read vulnerability, which stems from insufficient validation of input data. Attackers can exploit this vulnerability to compromise the confidentiality of services...

Huawei HarmonyOS information leakage vulnerability (CNVD-2026-28948)

Huawei HarmonyOS is a distributed operating system platform developed by Huawei, a Chinese company. Huawei HarmonyOS has a vulnerability related to information leakage, which stems from incorrect permission control settings. Attackers can exploit this vulnerability to compromise the confidentiali...

Huawei HarmonyOS Image Codec Module Out-of-Bounds Reading Vulnerability (CNVD-2026-29425)

Huawei HarmonyOS is an operating system developed by Chinese company Huawei. It is a full-scenario distributed operating system based on a microkernel architecture. The Huawei HarmonyOS’s media coding and decoding module contains a out-of-bounds read vulnerability, which allows attackers to explo...

Tenda BE12 Pro stack buffer overflow vulnerability (CNVD-2026-32964)

The Tenda BE12 Pro is a Wi-Fi 7 wireless router released by Tenda in January 2026. The Tenda BE12 Pro has a stack buffer overflow vulnerability. This vulnerability stems from the fromSafeClientFilter function in the /goform/SafeClientFilter file, which fails to properly handle the page parameter...

Tenda BE12 Pro stack buffer overflow vulnerability

The Tenda BE12 Pro is a Wi-Fi 7 wireless router released by Tenda in January 2026. The Tenda BE12 Pro has a stack buffer overflow vulnerability. This vulnerability stems from the fromDhcpListClient function in the /goform/DhcpListClient file, which fails to properly handle the page parameter. An...

Tenda BE12 Pro stack buffer overflow vulnerability (CNVD-2026-32962)

The Tenda BE12 Pro is a Wi-Fi 7 router released by Tenda in January 2026. The Tenda BE12 Pro has a stack buffer overflow vulnerability. This vulnerability stems from the fromSafeUrlFilter function in the /goform/SafeUrlFilter file, which fails to properly handle the parameter page. An attacker ca...

Adobe Audition Out-of-Bounds Write Vulnerability (CNVD-2026-31987)

Adobe Audition is an audio editing software developed by Adobe, a company based in the United States. Adobe Audition has a boundary violation vulnerability, which stems from improper handling of boundary checks for malicious files. Attackers can exploit this vulnerability to execute arbitrary cod...

Microsoft Excel heap buffer overflow vulnerability (CNVD-2026-29403)

Microsoft Office Excel is a spreadsheet processing software within the Microsoft Office suite, primarily used for data analysis, calculations, and chart creation. There is a heap buffer overflow vulnerability in Microsoft Office Excel, which stems from improper handling of objects in memory...

Microsoft Office SharePoint Server Cross-site Scripting Vulnerability (CNVD-2026-29411)

Microsoft Office SharePoint Server is a web-based content management and collaboration tool designed for enterprise customers by Microsoft Corporation. The initial version of this software existed as an Office component and still relies heavily on Office for providing features such as enterprise...

Microsoft Office Word resource management error vulnerability (CNVD-2026-29410)

Microsoft Office Word is a word processing software included in the Microsoft Office suite. It primarily provides features for document editing, formatting, and typesetting. There is a resource management vulnerability in Microsoft Office Word. This vulnerability stems from the software’s failure...

Siemens SICAM 8 product log information leakage vulnerability (CNVD-2026-29401)

The Siemens CPCI85 Central Processing/Communication is a central processing and communication device developed by the German company Siemens. The Siemens SICORE Base system is a core foundational software component of the SICAM 8 power automation platform, designed specifically for substation...

Siemens Simatic S7-PLCSim Advanced service denial vulnerability

Siemens Simatic S7-PLCSim Advanced is a high-level programmable controller simulation tool developed by the German company Siemens. Siemens Simatic S7-PLCSim Advanced has a denial-of-service vulnerability. This vulnerability stems from improper handling of high-capacity multicast network traffic...

Microsoft Visual Studio Code security feature bypass vulnerability (CNVD-2026-29404)

Microsoft Visual Studio Code is a lightweight yet powerful source code editor that supports multiple programming languages and extensions. Microsoft Visual Studio Code has a security feature bypass vulnerability, which stems from improper handling of requests from functions within an untrusted...

Siemens SICAM 8 product authorization issue and vulnerabilities

The Siemens CPCI85 Central Processing/Communication is a central processing and communication device developed by the German company Siemens. The Siemens SICORE Base system is a core foundational software component of the SICAM 8 power automation platform, designed specifically for substation...

Microsoft Office Information Leakage Vulnerability (CNVD-2026-28612)

Microsoft Office is a suite of office software products developed by the American company Microsoft. Common components of this product include Word, Excel, Access, PowerPoint, and FrontPage. Microsoft Office has information leakage vulnerabilities, and attackers can exploit these vulnerabilities ...

Siemens Opcenter X Token Expiration Vulnerability

Siemens Opcenter X is an industrial operations management and manufacturing execution system developed by the German company Siemens. Siemens Opcenter X has a token expiration vulnerability. Attackers can exploit this vulnerability to forge any JWT, bypass the authentication mechanism, and...

Microsoft Excel heap buffer overflow vulnerability (CNVD-2026-29406)

Microsoft Office Excel is a spreadsheet processing software in the Microsoft Office suite, primarily used for data organization, calculation, and chart analysis. Microsoft Office Excel has a heap buffer overflow vulnerability. This vulnerability stems from an inability to correctly validate the...

Microsoft Office Out-of-Bounds Reading Vulnerability (CNVD-2026-31555)

Microsoft Office is a suite of office software that provides functions such as document processing, spreadsheet calculations, and presentation creation. Microsoft Office has a out-of-bounds read vulnerability, which stems from an inability to properly validate memory boundaries, resulting in...

Microsoft Excel information leakage vulnerability (CNVD-2026-28560)

Microsoft Excel is a spreadsheet software within the Office suite developed by Microsoft Corporation. There is an information leakage vulnerability in Microsoft Excel, which stems from the inability of Excel to correctly check the heap memory boundaries when processing certain files. Attackers ca...

Microsoft Office Information Leakage Vulnerability (CNVD-2026-28614)

Microsoft Office is a suite of office software products developed by Microsoft Corporation in the United States. Common components of this product include Word, Excel, Access, PowerPoint, and FrontPage. Microsoft Office has information leakage vulnerabilities, and attackers can exploit these...

Microsoft Excel code execution vulnerability (CNVD-2026-28615)

Microsoft Office is a suite of office software products developed by Microsoft Corporation in the United States. Common components of this product include Word, Excel, Access, PowerPoint, and FrontPage. Microsoft Excel has a code execution vulnerability, which stems from the use of resources...