Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
33 results
May 25, 2026A vulnerability has been found in Edimax EW-7438RPn 1.31.CVE-2026-9482 · Other software · Edimax · reported by VulDBHigh 7.4
A vulnerability has been found in Edimax EW-7438RPn 1.31. This impacts the function formSDHCP of the file /goform/formSDHCP. Such manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026A flaw has been found in Edimax EW-7438RPn 1.31.CVE-2026-9481 · Other software · Edimax · reported by VulDBHigh 7.4
A flaw has been found in Edimax EW-7438RPn 1.31. This affects the function formStats of the file /goform/formStats. This manipulation of the argument submit-url causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026A vulnerability was detected in Edimax EW-7438RPn 1.31.CVE-2026-9480 · Other software · Edimax · reported by VulDBHigh 7.4
A vulnerability was detected in Edimax EW-7438RPn 1.31. The impacted element is the function formrefresh of the file /goform/formrefresh. The manipulation of the argument submit-url results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026A security vulnerability has been detected in Edimax EW-7438RPn 1.31.CVE-2026-9479 · Other software · Edimax · reported by VulDBHigh 7.4
A security vulnerability has been detected in Edimax EW-7438RPn 1.31. The affected element is the function formLogout of the file /goform/formLogout. The manipulation of the argument submit-url leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026A flaw has been found in Edimax EW-7438RPn 1.31.CVE-2026-9463 · Other software · Edimax · reported by VulDBHigh 7.4
A flaw has been found in Edimax EW-7438RPn 1.31. Affected by this issue is the function formLicence of the file /goform/formLicence. This manipulation of the argument submit-url causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026A vulnerability was detected in Edimax EW-7438RPn 1.31.CVE-2026-9462 · Other software · Edimax · reported by VulDBHigh 7.4
A vulnerability was detected in Edimax EW-7438RPn 1.31. Affected by this vulnerability is the function formWpsProxyEnable of the file /goform/formWpsProxyEnable. The manipulation of the argument submit-url results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026A security vulnerability has been detected in Edimax EW-7438RPn 1.31.CVE-2026-9461 · Other software · Edimax · reported by VulDBHigh 7.4
A security vulnerability has been detected in Edimax EW-7438RPn 1.31. Affected is the function formRadius of the file /goform/formRadius. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026A weakness has been identified in Edimax EW-7438RPn 1.31.CVE-2026-9460 · Other software · Edimax · reported by VulDBHigh 7.4
A weakness has been identified in Edimax EW-7438RPn 1.31. This impacts the function formAccept of the file /goform/formAccept. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026A security flaw has been discovered in Edimax EW-7438RPn 1.31.CVE-2026-9459 · Other software · Edimax · reported by VulDBHigh 7.4
A security flaw has been discovered in Edimax EW-7438RPn 1.31. This affects the function formConnectionSetting of the file /goform/formConnectionSetting. Performing a manipulation of the argument max_Conn/timeOut results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026A flaw has been found in Edimax EW-7438RPn 1.31.CVE-2026-9427 · Other software · Edimax · reported by VulDBHigh 7.4
A flaw has been found in Edimax EW-7438RPn 1.31. This impacts the function formWlSiteSurvey of the file /goform/formWlSiteSurvey of the component webs. This manipulation of the argument selSSID/submit-url causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026A vulnerability was detected in Edimax EW-7438RPn 1.31.CVE-2026-9426 · Other software · Edimax · reported by VulDBHigh 7.4
A vulnerability was detected in Edimax EW-7438RPn 1.31. This affects the function formHwSet of the file /goform/formHwSet. The manipulation of the argument Anntena/Mcs/regDomain/nic0Addr/nic1Addr/wlanAddr/wanAddr/wlanSSID/wlanChan/initgain/txcck/txofdm/submit-url results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026A security vulnerability has been detected in Edimax EW-7438RPn 1.31.CVE-2026-9425 · Other software · Edimax · reported by VulDBHigh 7.4
A security vulnerability has been detected in Edimax EW-7438RPn 1.31. The impacted element is the function formWlanMP of the file /goform/formWlanMP. The manipulation of the argument ateFunc/ateGain/ateTxCount/ateChan/ateRate/ateMacID/e2pTxPower1/e2pTxPower2/e2pTxPower3/e2pTxPower4/e2pTxPower5/e2pTxPower6/e2pTxPower7/e2pTx2Power1/e2pTx2Power2/e2pTx2Power3/e2pTx2Power4/e2pTx2Power5/e2pTx2Power6/e2pTx2Power7/ateTxFreqOffset/ateMode/ateBW/ateAntenna/e2pTxFreqOffset/e2pTxPwDeltaB/e2pTxPwDeltaG/e2pTxPwDeltaMix/e2pTxPwDeltaN/readE2P leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026A weakness has been identified in Edimax EW-7438RPn 1.31.CVE-2026-9424 · Other software · Edimax · reported by VulDBLow 2.1
A weakness has been identified in Edimax EW-7438RPn 1.31. The affected element is the function formWlanMP of the file /goform/formWlanMP of the component Content-Type Handler. Executing a manipulation of the argument ateFunc/ateGain/ateTxCount/ateChan/ateRate/ateMacID/e2pTxPower1/e2pTxPower2/e2pTxPower3/e2pTxPower4/e2pTxPower5/e2pTxPower6/e2pTxPower7/e2pTx2Power1/e2pTx2Power2/e2pTx2Power3/e2pTx2Power4/e2pTx2Power5/e2pTx2Power6/e2pTx2Power7/ateTxFreqOffset/ateMode/ateBW/ateAntenna/e2pTxFreqOffset/e2pTxPwDeltaB/e2pTxPwDeltaG/e2pTxPwDeltaMix/e2pTxPwDeltaN/readE2P can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2026A vulnerability was detected in Edimax EW-7438RPn 1.12.CVE-2026-9363 · Other software · Edimax · reported by VulDBLow 2.1
A vulnerability was detected in Edimax EW-7438RPn 1.12. This issue affects the function formEZCHNwlanSetup of the file /goform/formEZCHNwlanSetu of the component POST Request Handler. Performing a manipulation of the argument method results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
May 24, 2026A security vulnerability has been detected in Edimax EW-7438RPn 1.12.CVE-2026-9362 · Other software · Edimax · reported by VulDBLow 2.1
A security vulnerability has been detected in Edimax EW-7438RPn 1.12. This vulnerability affects the function formConnectionSetting of the file /goform/formConnectionSetting of the component Setting Handler. Such manipulation of the argument max_Conn/timeOut leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
May 24, 2026A weakness has been identified in Edimax EW-7438RPn 1.12.CVE-2026-9361 · Other software · Edimax · reported by VulDBLow 2.1
A weakness has been identified in Edimax EW-7438RPn 1.12. This affects the function formAccept of the file /goform/formAccep of the component POST Request Handler. This manipulation of the argument submit-url causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
May 24, 2026A security flaw has been discovered in Edimax EW-7438RPn 1.28a.CVE-2026-9360 · Other software · Edimax · reported by VulDBHigh 7.4
A security flaw has been discovered in Edimax EW-7438RPn 1.28a. Affected by this issue is the function formwlencrypt24g of the file /goform/formwlencrypt24g of the component POST Request Handler. The manipulation of the argument key1 results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
May 24, 2026A vulnerability was identified in Edimax EW-7438RPn 1.28a.CVE-2026-9359 · Other software · Edimax · reported by VulDBLow 2.1
A vulnerability was identified in Edimax EW-7438RPn 1.28a. Affected by this vulnerability is the function formHwSet of the file /goform/formHwSet of the component POST Request Handler. The manipulation of the argument Anntena/Mcs/regDomain/nic0Addr/nic1Addr/wlanAddr/wanAddr/wlanSSID/wlanChan/comd/initgain/txcck/txofdm leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
May 24, 2026A vulnerability was found in Edimax EW-7438RPn up to 1.31.CVE-2026-9348 · Other software · Edimax · reported by VulDBHigh 7.4
A vulnerability was found in Edimax EW-7438RPn up to 1.31. Affected by this vulnerability is an unknown functionality of the file /goform/mp of the component webs. The manipulation of the argument webs results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2026A vulnerability has been found in Edimax EW-7438RPn up to 1.31.CVE-2026-9347 · Other software · Edimax · reported by VulDBLow 2.1
A vulnerability has been found in Edimax EW-7438RPn up to 1.31. Affected is the function formWizSurvey of the file /goform/formWizSurvey of the component webs. The manipulation of the argument ip/mask/gateway leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2026A flaw has been found in Edimax EW-7438RPn up to 1.31.CVE-2026-9346 · Other software · Edimax · reported by VulDBHigh 7.4
A flaw has been found in Edimax EW-7438RPn up to 1.31. This impacts the function formWirelessTbl of the file /goform/formWirelessTbl of the component webs. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2026A vulnerability was detected in Edimax EW-7438RPn up to 1.31.CVE-2026-9345 · Other software · Edimax · reported by VulDBHigh 7.4
A vulnerability was detected in Edimax EW-7438RPn up to 1.31. This affects the function formWizSurvey of the file /goform/formWizSurvey of the component webs. Performing a manipulation of the argument ssid/manualssid/ip/mask/gateway results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2026A security vulnerability has been detected in Edimax EW-7438RPn up to 1.31.CVE-2026-9344 · Other software · Edimax · reported by VulDBHigh 7.4
A security vulnerability has been detected in Edimax EW-7438RPn up to 1.31. The impacted element is an unknown function of the file /goform/formWpsStart of the component webs. Such manipulation of the argument pinCode/wlan-url leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2026A weakness has been identified in Edimax EW-7438RPn up to 1.31.CVE-2026-9343 · Other software · Edimax · reported by VulDBLow 2.1
A weakness has been identified in Edimax EW-7438RPn up to 1.31. The affected element is the function formWpsStart of the file /goform/formWpsStart of the component webs. This manipulation of the argument pinCode causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EW-7438RPn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Edimax EW-7438RPn-v3 Mini 1.27 allows unauthenticated attackers to access the /wizard_reboot.asp page in unsetup mode, which discloses the Wi-Fi SSID and securiCVE-2020-37150 · Other software · EDIMAX Technology · reported by VulnCheckHigh 8.7
Edimax EW-7438RPn-v3 Mini 1.27 allows unauthenticated attackers to access the /wizard_reboot.asp page in unsetup mode, which discloses the Wi-Fi SSID and security key. Attackers can retrieve the wireless password by sending a GET request to this endpoint, exposing sensitive information without authentication.
- Product
- EW-7438RPn-v3 Mini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordedimax.comexploit-db.com
Feb 5, 2026Edimax EW-7438RPn-v3 Mini 1.27 is vulnerable to cross-site request forgery (CSRF) that can lead to command execution.CVE-2020-37149 · Other software · EDIMAX Technology · reported by VulnCheckMedium 5.1
Edimax EW-7438RPn-v3 Mini 1.27 is vulnerable to cross-site request forgery (CSRF) that can lead to command execution. An attacker can trick an authenticated user into submitting a crafted form to the /goform/mp endpoint, resulting in arbitrary command execution on the device with the user's privileges.
- Product
- EW-7438RPn Mini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordedimax.comexploit-db.com
Feb 5, 2026Edimax EW-7438RPn-v3 Mini 1.27 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands through the /gCVE-2020-37125 · Other software · EDIMAX Technology · reported by VulnCheckCritical 9.3
Edimax EW-7438RPn-v3 Mini 1.27 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands through the /goform/mp endpoint. Attackers can exploit the vulnerability by sending crafted POST requests with command injection payloads to download and execute malicious scripts on the device.
- Product
- EW-7438RPn Mini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordedimax.comexploit-db.com
Feb 3, 2026Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details through the wlencrypt_wiz.asp file.CVE-2020-37097 · Other software · EDIMAX Technology Co., Ltd. · reported by VulnCheckHigh 8.7
Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details through the wlencrypt_wiz.asp file. Attackers can access the script to retrieve sensitive information including WiFi network name and plaintext password stored in device configuration variables.
- Product
- EW-7438RPn Mini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordedimax.comexploit-db.com
Feb 3, 2026Edimax EW-7438RPn 1.13 contains a cross-site request forgery vulnerability in the MAC filtering configuration interface.CVE-2020-37096 · Other software · EDIMAX Technology Co., Ltd. · reported by VulnCheckMedium 5.1
Edimax EW-7438RPn 1.13 contains a cross-site request forgery vulnerability in the MAC filtering configuration interface. Attackers can craft malicious web pages to trick users into adding unauthorized MAC addresses to the device's filtering rules without their consent.
- Product
- EW-7438RPn Mini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordedimax.comexploit-db.com
Jun 20, 2025An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler.CVE-2025-34029 · Other software · Edimax · reported by VulnCheckCritical 9.4
An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler. The /goform/formSysCmd endpoint exposes a system command interface through the sysCmd parameter. A remote authenticated attacker can submit arbitrary shell commands directly, resulting in command execution as the root user. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-14 UTC.
- Product
- Edimax EW-7438RPn Mini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.combroadcom.com
Jun 20, 2025An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler.CVE-2025-34024 · Other software · Edimax · reported by VulnCheckCritical 9.4
An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint improperly handles user-supplied input to the command parameter. An authenticated attacker can inject shell commands using shell metacharacters to achieve arbitrary command execution as the root user. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-14 UTC.
- Product
- Edimax EW-7438RPn Mini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.combroadcom.com
Aug 8, 2019Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.CVE-2016-10863 · Other software · Edimax · reported by MITREHigh 8.8
Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.
- Product
- Ew-7438rpn Mini Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentestpartners.compentestpartners.com
Aug 13, 2018An issue was discovered in Edimax EW-7438RPn Mini v2 before version 1.26.CVE-2018-10569 · Other software · Edimax · reported by MITREMedium 6.1
An issue was discovered in Edimax EW-7438RPn Mini v2 before version 1.26. There is XSS in an SSID field.
- Product
- Edimax Ew-7438rpn V2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.