Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
773 results · page 11 of 16
Mar 8, 2026A vulnerability was determined in Wavlink WL-WN579X3-C 231124.CVE-2026-3716 · Other software · Wavlink · reported by VulDBLow 1.9
A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This vulnerability affects the function sub_401AD4 of the file /cgi-bin/adm.cgi. Executing a manipulation of the argument Hostname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 20260226 is able to resolve this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- WL-WN579X3-C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.wavlink.comgithub.com
Mar 8, 2026A vulnerability was determined in mkj Dropbear up to 2025.89.CVE-2026-3706 · Other software · mkj · reported by VulDBLow 1.7
A vulnerability was determined in mkj Dropbear up to 2025.89. Impacted is the function unpackneg of the file src/curve25519.c of the component S Range Check. This manipulation causes improper verification of cryptographic signature. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. Patch name: fdec3c90a15447bd538641d85e5a3e3ac981011d. To fix this issue, it is recommended to deploy a patch. The project maintainer explains: "Signature Malleability is not exploitable in SSH protocol. (...) [A] PoC doesn't exist for SSH implementation, but rather it's against the internal API."
- Product
- Dropbear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026A vulnerability was determined in Planet ICG-2510 1.0_20250811.CVE-2026-3697 · Other software · Planet · reported by VulDBLow 2.1
A vulnerability was determined in Planet ICG-2510 1.0_20250811. The impacted element is the function sub_40C8E4 of the file /usr/sbin/httpd of the component Language Package Configuration Handler. Executing a manipulation of the argument Language can lead to stack-based buffer overflow. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ICG-2510
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026A vulnerability was determined in Tenda FH451 1.0.0.9.CVE-2026-3678 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda FH451 1.0.0.9. Affected is the function sub_3C434 of the file /goform/AdvSetWan. This manipulation of the argument wanmode/PPPOEPassword causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026A vulnerability was determined in Freedom Factory dGEN1 up to 20260221.CVE-2026-3675 · Other software · Freedom Factory · reported by VulDBLow 1.9
A vulnerability was determined in Freedom Factory dGEN1 up to 20260221. Affected by this issue is the function FakeAppReceiver of the component org.ethosmobile.ethoslauncher. Executing a manipulation can lead to improper authorization. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dGEN1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Mar 7, 2026A vulnerability was determined in xlnt-community xlnt up to 1.6.1.CVE-2026-3664 · Other software · xlnt-community · reported by VulDBLow 1.9
A vulnerability was determined in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::compound_document::read_directory of the file source/detail/cryptography/compound_document.cpp of the component Encrypted XLSX File Parser. Executing a manipulation can lead to out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 147. Applying a patch is advised to resolve this issue.
- Product
- xlnt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026A vulnerability was determined in Wavlink WL-NU516U1 V240425.CVE-2026-3612 · Other software · Wavlink · reported by VulDBHigh 7.3
A vulnerability was determined in Wavlink WL-NU516U1 V240425. This affects the function sub_405AF4 of the file /cgi-bin/adm.cgi of the component OTA Online Upgrade. This manipulation of the argument firmware_url causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
- Product
- WL-NU516U1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026A vulnerability was determined in Tuya App and SDK 24.07.11 on Android.CVE-2026-3465 · Other software · Tuya · reported by VulDBLow 1.3
A vulnerability was determined in Tuya App and SDK 24.07.11 on Android. Affected by this vulnerability is an unknown functionality of the component JSON Data Point Handler. This manipulation of the argument cruise_time causes denial of service. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. There is ongoing doubt regarding the real existence of this vulnerability. The vendor disagrees with the conclusion of the finding: "The described vulnerability fails to prove its feasibility or exploitability by attackers. The issue essentially does not constitute a security vulnerability, aligning more closely with abnormal product functionality." These considerations are properly reflected within the CVSS vector.
- Product
- App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2026A vulnerability was determined in YosysHQ yosys up to 0.62.CVE-2026-3407 · Other software · YosysHQ · reported by VulDBLow 1.9
A vulnerability was determined in YosysHQ yosys up to 0.62. This affects the function Yosys::RTLIL::Const::set of the file kernel/rtlil.h of the component BLIF File Parser. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Applying a patch is the recommended action to fix this issue. It appears that the issue is not reproducible all the time.
- Product
- yosys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2026A vulnerability was determined in Tenda F453 1.0.0.3.CVE-2026-3398 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda F453 1.0.0.3. Affected is the function fromAdvSetWan of the file /goform/AdvSetWan of the component httpd. Executing a manipulation of the argument wanmode/PPPOEPassword can lead to buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- F453
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2026A vulnerability was determined in Squirrel up to 3.2.CVE-2026-3389 · Other software · Squirrel-lang · reported by VulDBLow 1.9
A vulnerability was determined in Squirrel up to 3.2. This vulnerability affects the function sqstd_rex_newnode in the library sqstdlib/sqstdrex.cpp. Executing a manipulation can lead to null pointer dereference. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Squirrel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026A vulnerability was determined in berry-lang berry up to 1.1.0.CVE-2026-3285 · Other software · berry-lang · reported by VulDBLow 1.9
A vulnerability was determined in berry-lang berry up to 1.1.0. The affected element is the function scan_string of the file src/be_lexer.c. This manipulation causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Patch name: 7149c59a39ba44feca261b12f06089f265fec176. Applying a patch is the recommended action to fix this issue.
- Product
- berry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026A vulnerability was determined in Tenda F453 1.0.0.3.CVE-2026-3272 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda F453 1.0.0.3. Affected is the function fromDhcpListClient of the file /goform/DhcpListClient of the component httpd. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- F453
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026A vulnerability was determined in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1.CVE-2026-3264 · Other software · go2ismail · reported by VulDBLow 2.1
A vulnerability was determined in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. Affected by this issue is some unknown functionality of the component Administrative Interface. Executing a manipulation can lead to execution after redirect. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Free-CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta.CVE-2026-3186 · Other software · feiyuchuixue · reported by VulDBLow 2.1
A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown functionality of the file /api/admin/sys-user/reset/password/ of the component Password Reset Handler. This manipulation of the argument userId causes use of default password. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.3.3-beta addresses this issue. Patch name: aefaabfd7527188bfba3c8c9eee17c316d094802. It is suggested to upgrade the affected component. The project was informed beforehand and acted very professional: "We have added authorization validation to the password reset interface; now only users with the corresponding permissions are allowed to perform password resets."
- Product
- sz-boot-parent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026A vulnerability was determined in Tenda F453 1.0.0.3.CVE-2026-3165 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda F453 1.0.0.3. Impacted is the function fromSetWifiGusetBasic of the file /goform/AdvSetWrlsafeset of the component httpd. This manipulation of the argument mit_ssid causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- F453
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026A vulnerability was determined in exiftool up to 13.49 on macOS.CVE-2026-3102 · Other software · Exiftool Project · reported by VulDBLow 2.1
A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.
- Product
- Exiftool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026A vulnerability was determined in MuYuCMS 2.7.CVE-2025-15589 · Other software · Muyucms · reported by VulDBLow 2
A vulnerability was determined in MuYuCMS 2.7. Affected is the function delete_dir_file of the file application/admin/controller/Template.php of the component Template Management Page. This manipulation of the argument temn/tp causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Muyucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Feb 23, 2026A vulnerability was determined in DataLinkDC dinky up to 1.2.5.CVE-2026-3053 · Other software · DataLinkDC · reported by VulDBMedium 5.5
A vulnerability was determined in DataLinkDC dinky up to 1.2.5. This affects the function addInterceptors of the file dinky-admin/src/main/java/org/dinky/configure/AppConfig.java of the component OpenAPI Endpoint. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dinky
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability was determined in erzhongxmu JEEWMS up to 3.7.CVE-2026-3028 · Other software · erzhongxmu · reported by VulDBLow 2.1
A vulnerability was determined in erzhongxmu JEEWMS up to 3.7. This vulnerability affects the function doAdd of the file src/main/java/com/jeecg/demo/controller/JeecgListDemoController.java. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JEEWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114.CVE-2026-3015 · Other software · UTT · reported by VulDBHigh 7.4
A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/formPolicyRouteConf. Executing a manipulation of the argument GroupName can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- HiPER 810G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability was determined in a466350665 Smart-SSO up to 2.1.1.CVE-2026-2972 · Other software · a466350665 · reported by VulDBLow 1.9
A vulnerability was determined in a466350665 Smart-SSO up to 2.1.1. This affects the function Save of the file smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/admin/UserController.java of the component Role Edit Page. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart-SSO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A vulnerability was determined in Jinher OA C6 up to 20260210.CVE-2026-2963 · Other software · Jinher · reported by VulDBLow 2.1
A vulnerability was determined in Jinher OA C6 up to 20260210. This issue affects some unknown processing of the file /C6/Jhsoft.Web.officesupply/OfficeSupplyTypeRight.aspx. This manipulation of the argument id/offsnum causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA C6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A vulnerability was determined in Zaher1307 tiny_web_server up to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b.CVE-2026-2940 · Other software · Zaher1307 · reported by VulDBMedium 5.5
A vulnerability was determined in Zaher1307 tiny_web_server up to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b. This affects the function tiny_web_server/tiny.c of the file tiny_web_server/tiny.c of the component URL Handler. This manipulation causes out-of-bounds write. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- tiny_web_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026A vulnerability was determined in D-Link DWR-M960 1.01.07.CVE-2026-2929 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_453140 of the file /boafrm/formWlAc of the component Wireless Access Control Endpoint. This manipulation of the argument submit-url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A vulnerability was determined in libvips up to 8.19.0.CVE-2026-2913 · Other software · Libvips · reported by VulDBLow 1.1
A vulnerability was determined in libvips up to 8.19.0. The affected element is the function vips_source_read_to_memory of the file libvips/iofuncs/source.c. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. Patch name: a56feecbe9ed66521d9647ec9fbcd2546eccd7ee. Applying a patch is the recommended action to fix this issue. The confirmation of the bugfix mentions: "[T]he impact of this is negligible, since this only affects custom seekable sources larger than 4 GiB (and the crash occurs in user code rather than libvips itself)."
- Product
- Libvips
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A vulnerability was determined in UTT HiPER 810G 1.7.7-171114.CVE-2026-2904 · Other software · UTT · reported by VulDBHigh 7.4
A vulnerability was determined in UTT HiPER 810G 1.7.7-171114. This affects the function strcpy of the file /goform/ConfigExceptAli. Executing a manipulation can lead to buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- HiPER 810G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A vulnerability was determined in D-Link DWR-M960 1.01.07.CVE-2026-2883 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_427D74 of the file /boafrm/formIpQoS. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A vulnerability was determined in Tenda A18 15.13.07.13.CVE-2026-2876 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda A18 15.13.07.13. This affects the function parse_macfilter_rule of the file /goform/setBlackRule. This manipulation of the argument deviceList causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- A18
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026A vulnerability was determined in D-Link DWR-M960 1.01.07.CVE-2026-2857 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was determined in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_423E00 of the file /boafrm/formPortFw of the component Port Forwarding Configuration Endpoint. This manipulation of the argument submit-url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- DWR-M960
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4.CVE-2026-2851 · Other software · yeqifu · reported by VulDBLow 2.1
A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This vulnerability affects the function addInport/updateInport/deleteInport of the file dataset\repos\warehouse\src\main\java\com\yeqifu\bus\controller\InportController.java of the component Inport Endpoint. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- warehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026A vulnerability was determined in CoCoTeaNet CyreneAdmin up to 1.3.0.CVE-2026-2693 · Other software · CoCoTeaNet · reported by VulDBLow 2.1
A vulnerability was determined in CoCoTeaNet CyreneAdmin up to 1.3.0. This vulnerability affects unknown code of the file /api/system/dashboard/getCount of the component System Info Endpoint. Executing a manipulation can lead to improper authorization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CyreneAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532).CVE-2026-2684 · Other software · Tsinghua Unigroup · reported by VulDBMedium 5.5
A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The impacted element is an unknown function of the file /Archive/ErecordManage/uploadFile.html. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Electronic Archives System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026A vulnerability was determined in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206.CVE-2026-2669 · Other software · Rongzhitong · reported by VulDBMedium 5.5
A vulnerability was determined in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This impacts an unknown function of the file /dm/dispatch/user/delete of the component User Handler. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Visual Integrated Command and Dispatch Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026A vulnerability was determined in Squirrel up to 3.2.CVE-2026-2659 · Other software · Squirrel-lang · reported by VulDBLow 1.9
A vulnerability was determined in Squirrel up to 3.2. Affected by this vulnerability is the function SQFuncState::PopTarget of the file src/squirrel/squirrel/sqfuncstate.cpp. Executing a manipulation of the argument _target_stack can lead to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Squirrel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026A vulnerability was determined in Beetel 777VR1 up to 01.00.09.CVE-2026-2618 · Other software · Beetel · reported by VulDBLow 2.9
A vulnerability was determined in Beetel 777VR1 up to 01.00.09. This impacts an unknown function of the component SSH Service. This manipulation causes risky cryptographic algorithm. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 777VR1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Feb 16, 2026A vulnerability was determined in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533.CVE-2026-2562 · Other software · JingDong · reported by VulDBLow 2.1
A vulnerability was determined in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This impacts the function cast_streen of the file /jdcapi of the component jdcweb_rpc. Executing a manipulation of the argument File can lead to Remote Privilege Escalation. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JD Cloud Box AX6600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026A vulnerability was determined in ZenTao up to 21.7.8.CVE-2026-2551 · Other software · Zentao · reported by VulDBLow 2.1
A vulnerability was determined in ZenTao up to 21.7.8. Affected by this vulnerability is the function delete of the file editor/control.php of the component Backup Handler. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026A vulnerability was determined in opencc JFlow up to 20260129.CVE-2026-2536 · Other software · opencc · reported by VulDBLow 2.1
A vulnerability was determined in opencc JFlow up to 20260129. This affects the function Imp_Done of the file src/main/java/bp/wf/httphandler/WF_Admin_AttrFlow.java of the component Workflow Engine. This manipulation of the argument File causes xml external entity reference. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- JFlow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2026A vulnerability was determined in Wavlink WL-WN579A3 up to 20210219.CVE-2026-2527 · Other software · Wavlink · reported by VulDBLow 2.1
A vulnerability was determined in Wavlink WL-WN579A3 up to 20210219. Affected is an unknown function of the file /cgi-bin/login.cgi. Executing a manipulation of the argument key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WL-WN579A3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026A vulnerability was determined in janet-lang janet up to 1.40.1.CVE-2026-2242 · Other software · janet-lang · reported by VulDBLow 1.9
A vulnerability was determined in janet-lang janet up to 1.40.1. This impacts the function janetc_if of the file src/core/specials.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called c43e06672cd9dacf2122c99f362120a17c34b391. It is advisable to implement a patch to correct this issue.
- Product
- janet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026A vulnerability was determined in D-Link DCS-933L up to 1.14.11.CVE-2026-2218 · Network & remote access · D-Link · reported by VulDBLow 2.1
A vulnerability was determined in D-Link DCS-933L up to 1.14.11. This affects an unknown function of the file /setSystemAdmin of the component alphapd. This manipulation of the argument AdminID causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DCS-933L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2026A vulnerability was determined in UTT 进取 521G 3.1.1-190816.CVE-2026-2188 · Other software · UTT · reported by VulDBHigh 7.3
A vulnerability was determined in UTT 进取 521G 3.1.1-190816. The impacted element is the function sub_446B18 of the file /goform/formPdbUpConfig. Executing a manipulation of the argument policyNames can lead to os command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- 进取 521G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2026A vulnerability was determined in mwielgoszewski doorman up to 0.6.CVE-2026-2153 · Other software · mwielgoszewski · reported by VulDBLow 2.1
A vulnerability was determined in mwielgoszewski doorman up to 0.6. This issue affects the function is_safe_url of the file doorman/users/views.py. Executing a manipulation of the argument Next can lead to open redirect. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- doorman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Feb 8, 2026A vulnerability was determined in Tenda TX9 up to 22.03.02.10_multi.CVE-2026-2139 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda TX9 up to 22.03.02.10_multi. Affected by this vulnerability is the function sub_432580 of the file /goform/fast_setting_wifi_set. This manipulation of the argument ssid causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- TX9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2026A vulnerability was determined in BurtTheCoder mcp-maigret up to 1.0.12.CVE-2026-2130 · Other software · BurtTheCoder · reported by VulDBMedium 5.3
A vulnerability was determined in BurtTheCoder mcp-maigret up to 1.0.12. This affects an unknown part of the file src/index.ts of the component search_username. Executing a manipulation of the argument Username can lead to command injection. The attack may be launched remotely. Upgrading to version 1.0.13 is able to mitigate this issue. This patch is called b1ae073c4b3e789ab8de36dc6ca8111ae9399e7a. Upgrading the affected component is advised.
- Product
- mcp-maigret
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2026A vulnerability was determined in UTT HiPER 810 1.7.4-141218.CVE-2026-2118 · Other software · UTT · reported by VulDBHigh 7.3
A vulnerability was determined in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_4407D4 of the file /goform/formReleaseConnect of the component rehttpd. Executing a manipulation of the argument Isp_Name can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- HiPER 810
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2026A vulnerability was determined in jsbroks COCO Annotator up to 0.11.1.CVE-2026-2108 · Other software · jsbroks · reported by VulDBMedium 5.5
A vulnerability was determined in jsbroks COCO Annotator up to 0.11.1. This impacts an unknown function of the file /api/info/long_task of the component Endpoint. This manipulation causes denial of service. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- COCO Annotator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2026A vulnerability was determined in D-Link DIR-823X 250416.CVE-2026-2081 · Network & remote access · D-Link · reported by VulDBLow 2
A vulnerability was determined in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_password. This manipulation of the argument http_passwd causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DIR-823X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026A vulnerability was determined in D-Link DIR-823X 250416.CVE-2026-2061 · Network & remote access · D-Link · reported by VulDBLow 2
A vulnerability was determined in D-Link DIR-823X 250416. Affected by this issue is the function sub_424D20 of the file /goform/set_ipv6. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DIR-823X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.