Search
4,652 CVEs
CVEs (4,652, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 301–325 of 4,652 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-40615 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A… | |
| CVE-2026-40627 | CRITICAL | 9.1 | 2026-10-20 | An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted … | |
| CVE-2026-41222 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specia… | |
| CVE-2026-41223 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A spec… | |
| CVE-2026-42019 | CRITICAL | 9.1 | 2026-10-20 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A speci… | |
| CVE-2026-112712 | CRITICAL | Patched | 9.1 | 2026-10-20 | @fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to… |
| CVE-2026-10133 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP … | |
| CVE-2026-10135 | CRITICAL | 9.1 | 2026-10-20 | A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request… | |
| CVE-2026-10136 | CRITICAL | 9.1 | 2026-10-20 | A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafte… | |
| CVE-2026-10137 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially craft… | |
| CVE-2026-10138 | CRITICAL | 9.1 | 2026-10-20 | A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP… | |
| CVE-2026-10139 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP requ… | |
| CVE-2026-10141 | CRITICAL | 9.1 | 2026-10-20 | A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firm… | |
| CVE-2026-10131 | CRITICAL | 9.1 | 2026-10-20 | An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafte… | |
| CVE-2026-10132 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially craf… | |
| CVE-2026-105772 | CRITICAL | Patched | — | 2026-10-20 | Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files mat… |
| CVE-2026-103119 | CRITICAL | Patched | 9.1 | 2026-10-20 | Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the nex… |
| CVE-2026-101356 | CRITICAL | Patched | 9.1 | 2026-10-20 | Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between… |
| CVE-2026-101296 | CRITICAL | Patched | — | 2026-10-20 | A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed att… |
| CVE-2026-109395 | HIGH | Patched | 9.1 | 2026-10-20 | Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references … |
| CVE-2024-4457 | CRITICAL | 9.1 | 2026-10-18 | The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input… | |
| CVE-2026-110653 | CRITICAL | 9.1 | 2026-10-17 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versi… | |
| CVE-2025-30046 | CRITICAL | — | 2026-10-23 | In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data … | |
| CVE-2026-94267 | CRITICAL | Patched | 9.0 | 2026-10-23 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability c… |
| CVE-2026-111811 | CRITICAL | Patched | 9.0 | 2026-10-21 | Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traf… |