Overview of incoming advisories.
2179 results found
A stack-based buffer overflow vulnerability has been identified in TOTOLINK NR1800X firmware version 9.1.0u.6681_B20230703. The vulnerability exists in the setUploadSetting function within the /cgi-bin/cstecgi.cgi file. Attackers can exploit this by manipulating the FileName argument to trigger a stack-based buffer overflow. The attack vector is remote, requiring no physical access to the device. A public exploit has already been released, increasing the risk of active exploitation. TOTOLINK NR1800X is a network router/modem device, making this vulnerability particularly impactful for network infrastructure security. The vulnerability has been assigned CVE-2026-82616 and is tracked in VulDB. Organizations using the affected firmware version should monitor for patches from TOTOLINK. The public availability of the exploit significantly raises the urgency of remediation.
View original advisory →A critical OS command injection vulnerability has been identified in multiple D-Link NAS devices, including the DNS-320L, DNS-327L, DNS-340L, and DNS-345 models up to firmware version 20260717. The vulnerability resides in the /cgi-bin/isomount_mgr.cgi file within the ISO Image Handler component. By manipulating the 'upIsoRootPath' argument, an attacker can inject arbitrary OS commands. The attack is remotely exploitable without requiring physical access to the device. A public exploit is already available, significantly increasing the risk of active exploitation in the wild. D-Link NAS devices are commonly used in home and small business environments, making this a widespread risk. Users are advised to apply patches or mitigations as soon as they become available from D-Link.
View original advisory →CVE-2026-51681 describes an incorrect access control vulnerability in the setRemoteCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to expose WAN-side administration interfaces by sending a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint. No authentication is required to exploit this vulnerability, making it particularly dangerous for internet-facing devices. The affected product is a consumer/SOHO router manufactured by TOTOLINK. Successful exploitation could allow attackers to enable or reconfigure remote management settings without authorization. This type of vulnerability is common in IoT and home networking equipment where firmware access controls are improperly implemented. References include GitHub-hosted vendor coordination disclosures and the official TOTOLINK website and firmware download page.
View original advisory →CVE-2026-51725 describes an incorrect access control vulnerability in the NTPSyncWithHost function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to manipulate the device's system clock by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No authentication or credentials are required to exploit this vulnerability, making it trivially accessible to attackers. Manipulation of the device clock can have downstream effects on time-sensitive security functions such as certificate validation, logging, and scheduled tasks. The vulnerability was disclosed via GitHub repositories coordinating CVE vendor communication and is listed on the NVD. TOTOLINK has been notified through coordinated disclosure efforts. The affected product is a consumer/SOHO router, placing it in the IoT and network infrastructure risk category. Users are advised to check for firmware updates or apply mitigations as available.
View original advisory →CVE-2026-79750 affects MCPHub, a unified hub for managing and orchestrating multiple MCP servers and APIs. Prior to version 1.0.30, a broken access control vulnerability exists in the tool-execution API, which fails to enforce ownership/scoping rules that are otherwise applied to list views and config edits. Any authenticated non-admin user can invoke tools on MCP servers owned by other users, even servers they cannot view via GET /api/servers. This cross-tenant compromise enables attackers to read arbitrary host files (e.g., /etc/passwd, secrets) and conduct Server-Side Request Forgery (SSRF) using the victim server owner's cloud API keys and credentials. The vulnerability has been patched in MCPHub version 1.0.30. Organizations running earlier versions should upgrade immediately to prevent unauthorized cross-tenant access and potential data exfiltration.
View original advisory →A critical code injection vulnerability has been identified in SeaCMS versions up to 13.6. The vulnerability resides in the parseIf function within search.php, part of the Template Engine component. Attackers can manipulate the 'searchtype' argument to inject and execute arbitrary code remotely. The exploit has been publicly disclosed on GitHub, increasing the risk of widespread exploitation. No authentication appears to be required to exploit this vulnerability remotely. The affected product is SeaCMS, a popular Chinese content management system. The public availability of a proof-of-concept exploit makes this a high-priority patching target for affected installations.
View original advisory →A critical security vulnerability has been identified in Tenda AC18 firmware version 15.03.05.19. The flaw resides in the /goform/telnet endpoint within the Telnet Handler component. The vulnerability allows attackers to bypass authentication entirely, enabling unauthorized remote access. The attack vector is network-based and requires no authentication or special privileges. A public exploit has already been released, significantly raising the risk of active exploitation. The vulnerability is classified as missing authentication, which is a fundamental security control failure. Affected users should apply patches or mitigations as soon as possible to prevent unauthorized access to their routers.
View original advisory →A SQL injection vulnerability has been identified in itsourcecode Online Medicine Delivery System version 1.0. The flaw exists in the Customer::find_phone function within the /passwordrecover.php file, part of the Password Recovery Interface component. An attacker can manipulate the 'phonenumber' argument to perform SQL injection attacks remotely. The vulnerability is exploitable over the network without requiring physical access. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability has been assigned CVE-2026-82615 and is tracked in VulDB. Affected users of the itsourcecode Online Medicine Delivery System 1.0 are advised to apply patches or mitigations promptly. The public disclosure of the exploit significantly elevates the urgency for remediation.
View original advisory →A stack-based buffer overflow vulnerability has been identified in D-Link DIR-825M firmware version 1.1.8. The flaw exists in the function sub_41802C within the file /boafrm/formLtefotaUpgradeFibocom, which is part of the LTE Module Firmware Upgrade component. The vulnerability is triggered by manipulating the 'fota_url' argument, leading to a stack-based buffer overflow condition. The attack can be executed remotely without physical access to the device. A public exploit has already been published, increasing the risk of active exploitation. This affects IoT and network infrastructure devices, specifically D-Link routers with LTE capabilities. The availability of a public exploit makes this a high-priority vulnerability for patching and mitigation.
View original advisory →CVE-2026-51720 describes an incorrect access control vulnerability in the delIpPortFilterRules function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to delete firewall filter rules by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No authentication is required to exploit this vulnerability, making it particularly dangerous as attackers can silently weaken the device's firewall posture. Successful exploitation could expose the network to further attacks by removing protective filtering rules. The vulnerability was reported via GitHub-hosted CVE vendor coordination repositories and affects TOTOLINK networking hardware. This type of unauthenticated access control bypass in network infrastructure devices poses significant risk to home and small business users.
View original advisory →CVE-2026-81892 affects EasyAdmin, an admin generator for Symfony applications, across versions 4.0.0 to 4.29.16 and up to 5.5.1. The vulnerability stems from EasyAdmin routing all backend requests through a single dashboard route and swapping controllers based on an unvalidated routeName query parameter. Because Symfony's security firewall evaluates access_control rules against the original dashboard URL before the controller swap occurs, path-based access control rules protecting target routes are never evaluated. This allows a low-privilege backend user with knowledge of a target route's name to execute that route's controller, effectively bypassing path-based authorization. Routes protected by inline authorization checks such as #[IsGranted] or denyAccessUnlessGranted() remain unaffected. The vulnerability has been patched in EasyAdmin versions 4.29.16 and 5.5.1. Fixes are available via two separate commits on the EasyCorp GitHub repository.
View original advisory →CVE-2026-82862 affects Hulumi versions before v1.3.2, where the threat-model helper script is resolved from an unsafe root directory. This flaw allows workspace files to shadow the intended helper script, enabling attackers to place malicious files in the workspace. When a local skill execution occurs, the malicious file is executed instead of the legitimate helper script, resulting in arbitrary code execution. The vulnerability is classified as high severity. Users are advised to upgrade to Hulumi v1.3.2 or later to remediate the issue. The advisory is referenced by both the GitHub Security Advisories and VulnCheck.
View original advisory →Microsoft has disclosed details of a new ClickFix variant called TerminalFix that tricks users into executing malicious commands via Windows Terminal or PowerShell. Unlike traditional ClickFix campaigns that use the Windows Run dialog, TerminalFix directs victims to Windows Terminal or PowerShell, increasing the likelihood of executing complex payloads. The campaign uses fake Cloudflare CAPTCHA pages as a social engineering lure. The ultimate payload is a reverse-tunnel backdoor, allowing attackers persistent remote access. This technique leverages legitimate-looking CAPTCHA prompts to bypass user suspicion and security controls. The shift to PowerShell/Terminal increases the capability for attackers to run sophisticated scripts. This represents an evolution of the ClickFix social engineering technique. Organizations using Windows environments are at heightened risk from this campaign.
View original advisory →CVE-2026-15980 describes a critical authentication bypass vulnerability in the MyHome Core plugin for WordPress, affecting all versions up to and including 4.4.5. The flaw stems from missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. Unauthenticated attackers can exploit this to generate activation tokens for unconfirmed user accounts and obtain valid authentication cookies, potentially gaining administrator-level access. Exploitation requires the MyHome theme to be in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must lack the myhome_agent_confirmed user meta flag. This vulnerability poses a significant risk to real estate WordPress sites using this theme. No patch version is explicitly mentioned beyond the affected range of 4.4.5 and below.
View original advisory →A vulnerability identified as CVE-2026-82539 affects TOTOLINK A720R firmware version 4.1.5cu.630_B20250509. The flaw resides in the setMacFilterRules function within the cstecgi.cgi file, specifically in the MAC Filtering component. Manipulation of the 'desc' argument can trigger memory corruption, potentially allowing an attacker to execute arbitrary code or crash the device. The attack vector is remote, requiring no physical access to the target device. A public exploit has already been disclosed and is available for use, increasing the risk of active exploitation. TOTOLINK routers are commonly deployed in home and small business environments, widening the potential attack surface. The vulnerability poses a significant risk to network infrastructure security.
View original advisory →Multiple critical security vulnerabilities have been disclosed in widely-used WordPress plugins and themes including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. The flaws, tracked by Wordfence and Patchstack, can lead to authentication bypass, account takeover, and arbitrary remote code execution. At least one CVE, CVE-2026-76581, carries a near-maximum CVSS score of 9.8. The vulnerabilities span authentication bypass and potentially other critical classes. Successful exploitation could allow attackers to fully compromise affected WordPress sites. Site administrators are urged to apply patches immediately to mitigate risk of site takeover or RCE.
View original advisory →Ten malicious versions of the npm package @7nohe/openapi-react-query-codegen were published by attackers who exploited an exposed npm publishing workflow in the package's CI/CD pipeline. The compromise allowed unauthorized publication of malicious package versions to the npm registry. The article details indicators of compromise (IOCs) associated with the malicious versions and provides recovery steps for affected users and maintainers. This incident highlights the risk of exposed secrets or misconfigured publishing workflows in open source projects. The attack falls under the category of software supply chain compromise, where downstream consumers of the package may have been impacted by installing the malicious versions.
View original advisory →McKesson, a major healthcare and pharmaceutical distribution company, has disclosed a cybersecurity incident involving unauthorized access to third-party applications. The ShinyHunters extortion group has claimed responsibility, alleging they stole 284 million patient data records. The breach involves sensitive patient information, making it one of the largest healthcare data theft incidents. McKesson confirmed unauthorized access occurred but has not yet provided full details on the scope of the breach. ShinyHunters is a well-known threat actor group associated with large-scale data theft and extortion operations targeting high-value organizations. The incident raises significant concerns about third-party application security in the healthcare sector. Regulatory and legal implications are likely given the scale of the alleged data theft and the sensitive nature of patient records.
View original advisory →CVE-2026-15369 affects the Custom User Registration Fields for WooCommerce WordPress plugin in versions up to and including 2.2.3. The vulnerability allows unauthenticated attackers to escalate privileges to Administrator level by manipulating the afreg_select_user_role parameter in the WooCommerce Store API checkout request. The flaw exists because the plugin fails to validate the attacker-controlled role value against the admin-configured allowed role list before passing it to WP_User::add_role(). An attacker can exploit this during the checkout process by submitting a modified JSON body specifying 'administrator' or any other role slug. The exploit is conditional on the 'User Role Selection' setting being enabled in the plugin configuration. The vulnerability resides in the af_reg_checkout_data_to_order_meta_data_block() and af_reg_custom_order_processing_function() functions. No authentication is required to exploit this vulnerability, making it particularly dangerous for affected WordPress/WooCommerce installations.
View original advisory →CVE-2026-82454 describes a critical authentication bypass vulnerability in the Omnivore API (packages/api) affecting Apple Sign-In token verification. The decodeAppleToken function incorrectly trusted the attacker-supplied 'alg' field from the JWT header, passing it directly to jwt.verify() as the allowed algorithm. By setting alg=HS256 and using Apple's publicly available RSA public key as an HMAC secret, an attacker could forge a valid-looking JWT token. The jsonwebtoken v8 library used did not validate key/algorithm compatibility, enabling the bypass. This flaw allowed an attacker to impersonate any Apple-linked Omnivore account without knowing the victim's credentials. The vulnerability was fixed in commit abf53d6. This is a classic JWT algorithm confusion attack, a well-known class of vulnerability in token-based authentication systems.
View original advisory →