Search
333 CVEs · Critical severity
CVEs (333)
Showing 251–275 of 333
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-41222 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specia… | |
| CVE-2026-40627 | CRITICAL | 9.1 | 2026-10-20 | An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted … | |
| CVE-2026-40615 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A… | |
| CVE-2026-35499 | CRITICAL | 9.1 | 2026-10-20 | An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HT… | |
| CVE-2026-33568 | CRITICAL | 9.1 | 2026-10-20 | A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially c… | |
| CVE-2026-28763 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A sp… | |
| CVE-2026-112712 | CRITICAL | Patched | 9.1 | 2026-10-20 | @fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to… |
| CVE-2026-10141 | CRITICAL | 9.1 | 2026-10-20 | A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firm… | |
| CVE-2026-10139 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP requ… | |
| CVE-2026-10138 | CRITICAL | 9.1 | 2026-10-20 | A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP… | |
| CVE-2026-10137 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially craft… | |
| CVE-2026-10136 | CRITICAL | 9.1 | 2026-10-20 | A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafte… | |
| CVE-2026-10135 | CRITICAL | 9.1 | 2026-10-20 | A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request… | |
| CVE-2026-10133 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP … | |
| CVE-2026-10132 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially craf… | |
| CVE-2026-10131 | CRITICAL | 9.1 | 2026-10-20 | An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafte… | |
| CVE-2016-20101 | CRITICAL | Patched | 8.1 | 2026-10-20 | Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the… |
| CVE-2026-112380 | CRITICAL | Patched | 9.9 | 2026-10-20 | Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator… |
| CVE-2026-113709 | CRITICAL | Patched | 9.9 | 2026-10-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm … |
| CVE-2026-113708 | CRITICAL | Patched | 9.9 | 2026-10-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query value… |
| CVE-2026-113802 | CRITICAL | 9.8 | 2026-10-20 | Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsaniti… | |
| CVE-2026-113672 | CRITICAL | Patched | 9.9 | 2026-10-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files wi… |
| CVE-2026-105772 | CRITICAL | Patched | — | 2026-10-20 | Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files mat… |
| CVE-2026-93475 | CRITICAL | — | 2026-10-20 | The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO… | |
| CVE-2026-86471 | CRITICAL | Patched | — | 2026-10-20 | An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB o… |