2026

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scrip

In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.

D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which can b

An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, B

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin al

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backen

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/acco

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission gu

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, b

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label

The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattende

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerabili

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerab

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerabil

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function.

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. T

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnera

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vu

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnera

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vul

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulne

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerab

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerabi

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerabil

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerabili

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerabili

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerabili

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. The vulnerabilit

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cg

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi inter

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vul

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerabili

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulne

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerabili

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerab

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerabil

Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability i

Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vuln

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is cau

Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability

Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vul

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability i

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is c

Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerabil