Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-10 07:25Z
2026-04-28
2026-04-28 09:16Z
CRIT

CVE-2026-7242 — Totolink: Executing a manipulation of the argument enabled can lead to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7242

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enabled can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-28
2026-04-28 09:16Z
CRIT

CVE-2026-7241 — Totolink: Performing a manipulation of the argument wifiOff results in os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7241

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument wifiOff results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-28
2026-04-28 09:16Z
HIGH

CVE-2026-40978 — SQL: injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-40978

SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5) CVSSv3.1 8.8 (HIGH)

CWECWE 89TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-28
2026-04-28 08:16Z
CRIT

CVE-2026-7240 — Such manipulation of the argument User leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7240

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument User leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-28
2026-04-28 08:16Z
HIGH

CVE-2024-54013 — Hanwhavision Knb-2000_firmware: Penetration Testing engineers at Amazon have identified a security flaw related to request handling

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-54013

Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server component that could, under certain conditions, lead to unintended access to protected functions. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

CWECWE 306VNDHanwhavisionVNDPenetrationTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-28
2026-04-28 07:16Z
HIGH

CVE-2026-40967 — Spring: In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-40967

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5) CVSSv3.1 8.6 (HIGH)

CWECWE 94VNDSpringTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-04-28
2026-04-28 01:16Z
CRIT

CVE-2026-7204 — Totolink: This manipulation of the argument enable causes os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7204

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument enable causes os command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-04-28
2026-04-28 01:16Z
CRIT

CVE-2026-7203 — Totolink: The manipulation of the argument enable results in os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7203

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-28
2026-04-28 01:16Z
CRIT

CVE-2026-7202 — The manipulation of the argument wscDisabled leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7202

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument wscDisabled leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-28
2026-04-28 01:16Z
CRIT

CVE-2026-32644 — Specific: firmware versions of Milesight AIOT cameras use SSL certificates with default private keys.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32644

Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys. CVSSv3.1 9.8 (CRITICAL)

CWECWE 321VNDSpecificTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-28
2026-04-28 01:16Z
HIGH

CVE-2026-20766 — An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20766

An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras. CVSSv3.1 8.8 (HIGH)

CWECWE 122TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-28
2026-04-28 00:16Z
HIGH

CVE-2026-41371 — OpenClaw: before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41371

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session reset operations. Attackers can rotate target sessions, archive prior transcript state, and force new session IDs without requiring admin scope by exploiting improper authorization checks in the chat.send path. CVSSv3.1 8.5 (HIGH)

CWECWE 863VNDOpenclawTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-04-28
2026-04-28 00:16Z
HIGH

CVE-2026-41364 — OpenClaw: before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41364

OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files. Attackers can exploit this by uploading tar archives containing symlinks to escape the sandbox and overwrite files on the remote host. CVSSv3.1 8.1 (HIGH)

CWECWE 59VNDOpenclawTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-04-28
2026-04-28 00:16Z
CRIT

CVE-2026-40976 — Spring: In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-40976

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4 CVSSv3.1 9.1 (CRITICAL)

CWECWE 862VNDSpringTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-04-28
2026-04-28 00:16Z
HIGH

CVE-2026-27785 — Specific: firmware versions of Milesight AIOT camera firmware contain hard-coded credentials.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27785

Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials. CVSSv3.1 8.8 (HIGH)

CWECWE 798VNDSpecificTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-27
2026-04-27 22:16Z
HIGH

CVE-2026-7160 — Tenda: Executing a manipulation of the argument datasize can lead to command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7160

A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation of the argument datasize can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 8.8 (HIGH)

CWECWE 74CWECWE 77VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-27
2026-04-27 21:16Z
CRIT

CVE-2026-7156 — Totolink: The manipulation of the argument HTTP results in os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7156

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument HTTP results in os command injection. The attack may be launched remotely. The exploit is now public and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 21:16Z
CRIT

CVE-2026-7155 — The manipulation of the argument admpass leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7155

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 21:16Z
CRIT

CVE-2026-7154 — Executing a manipulation of the argument tty_server can lead to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7154

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument tty_server can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 21:16Z
CRIT

CVE-2024-46636 — NASA: Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-46636

NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the category parameter CVSSv3.1 9.4 (CRITICAL)

CWECWE 89VNDNasaTYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2026-04-27
2026-04-27 20:16Z
CRIT

CVE-2026-7153 — Performing a manipulation of the argument sys_info results in os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7153

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sys_info results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 20:16Z
CRIT

CVE-2026-7152 — Totolink: Such manipulation of the argument telnet_enabled leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7152

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument telnet_enabled leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 20:16Z
HIGH

CVE-2026-7151 — Tenda: This manipulation of the argument destNet causes stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7151

A vulnerability was determined in Tenda HG3 2.0. Impacted is the function formUploadConfig of the file /boaform/formIPv6Routing. This manipulation of the argument destNet causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 8.8 (HIGH)

CWECWE 121CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-27
2026-04-27 20:16Z
HIGH

CVE-2026-6741 — LatePoint: The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-6741

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.4.1. This is due to a missing authorization check in the execute() method of the connect-customer-to-wp-user ability, which only requires the customer__edit capability granted to the latepoint_agent role by default, without verifying whether the target WordPress user ID belongs to a privileged account. This makes it p CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDLatepointTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-27
2026-04-27 19:16Z
CRIT

CVE-2026-35903 — MERCURY: This allows an attacker with network access to reuse session parameters and issue unauthorized

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-35903

MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authentication in an initial DESCRIBE request, the device does not verify the Digest response parameter in subsequent RTSP requests within the same session. As a result, RTSP methods such as SETUP, PLAY, and TEARDOWN can be processed even when the Authorization header contains an empty or invalid response value, as long as the CVSSv3.1 9.8 (CRITICAL)

CWECWE 287VNDMercuryTYPVulnerability
9.8
CVSS v3.1
99
Edit Score