CVE Records

SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

Android Framework Integer Overflow Vulnerability

Poly Voice – Possible Remote Control of Certain Poly Devices

Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow

TRENDnet TEW-432BRP formWPS command injection

TRENDnet TEW-432BRP formSetRoute command injection

Oracle E-Business Suite Improper Privilege Management Vulnerability

Compromised Nx Console version 18.95.0

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection

luci-app-https-dns-proxy Authenticated Command Injection via setInitAction

Microsoft SharePoint Remote Code Execution Vulnerability

Ubiquiti UniFi OS Improper Input Validation Vulnerability

Ubiquiti UniFi OS Improper Access Control Vulnerability

Ubiquiti UniFi OS Path Traversal Vulnerability

Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

LiteSpeed cPanel Plugin Privilege Escalation Vulnerability

XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

Microsoft Defender Elevation of Privilege Vulnerability

Microsoft Defender Denial of Service Vulnerability

vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection

Daemon Tools Lite Embedded Malicious Code Vulnerability

Microsoft Exchange Server Spoofing Vulnerability

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

D-Link DNS-320 webfile_mgr.cgi chown os command injection

D-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command injection

Tenda AC6 httpd getLogFile get_log_file os command injection

Tenda AC6 httpd WifiApScan formWifiApScan os command injection

Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection

Tenda AC6 httpd telnet os command injection

Wavlink NU516U1 login.cgi sys_login1 os command injection

Wavlink NU516U1 wireless.cgi WifiBasic os command injection

Wavlink NU516U1 wireless.cgi advance os command injection

Wavlink NU516U1 adm.cgi wzdapMesh os command injection

Wavlink NU516U1 adm.cgi wzdap os command injection

Wavlink NU516U1 adm.cgi wifi_region os command injection

Wavlink NU516U1 adm.cgi wan os command injection

Wavlink NU516U1 adm.cgi wzdrepeater os command injection

Wavlink NU516U1 adm.cgi change_wifi_password os command injection

LiteLLM: SQL injection in Proxy API key verification

LiteLLM: Authenticated command execution via MCP stdio test endpoints

Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

WDR201A WiFi Extender OS Command Injection via wireless.cgi

Apache HTTP Server: http2: double free and possible RCE on early reset

Wavlink WL-WN570HA1 adm.cgi set_sys_adm command injection

TRENDnet TEW-821DAP Firmware Udpate diagnostic tools_diagnostic os command injection

TRENDnet TEW-821DAP tools_diagnostic os command injection

WebPros cPanel and WHM Authentication Bypass via Login Flow

Tenda F456 httpd WriteFacMac FromWriteFacMac command injection

Linksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injection

Tenda F453 Telnet Service telnet TendaTelnet command injection

crypto: algif_aead - Revert to operating out-of-place

Cisco Identity Services Engine Remote Code Execution Vulnerability

Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability

Microsoft SharePoint Server Spoofing Vulnerability

Microsoft Defender Elevation of Privilege Vulnerability

Windows Shell Spoofing Vulnerability

Microsoft SharePoint Server Spoofing Vulnerability

Fortinet FortiSandbox OS Command Injection Vulnerability

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

D-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injection

Windmill < 1.603.3 File Ownership Handling SQLi RCE

Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint

Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload

Fortinet FortiClient EMS Improper Access Control Vulnerability

Trendnet TEW-657BRM setup.cgi vpn_drop os command injection

Trendnet TEW-657BRM setup.cgi vpn_connect os command injection

Trendnet TEW-657BRM setup.cgi ping_test os command injection

Trendnet TEW-657BRM setup.cgi edit os command injection

Trendnet TEW-657BRM setup.cgi add_wps_client os command injection

Tenda G103 Setting gpon.lua action_set_net_settings command injection

Tenda G103 Setting system.lua action_set_system_settings command injection

Google Dawn Use-After-Free Vulnerability

TRENDnet TEW-713RE setSysAdm command injection

TRENDnet TEW-713RE addRouting sub_421494 command injection

Tenda CH22 WriteFacMac FormWriteFacMac command injection

Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality

-

TrueConf Client Update Integrity Verification Bypass

Squid vulnerable to Denial of Service in ICP Request handling

Trivy ecosystem supply chain briefly compromised

Insufficient input validation leading to memory overread

AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

Tiandy Easy7 Integrated Management Platform Configuration ImportSystemConfiguration.jsp os command injection

Linksys MR9600 SmartConnect.lua smartConnectConfigure os command injection

Tenda F453 WriteFacMac FormWriteFacMac privilege escalation

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

-

Tenda AC8 Web UploadCfg route_set_user_policy_rule os command injection

LB-LINK BL-WR9000 set_wifi sub_458754 command injection