What needs attention now.

Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a crafted POST request to /c…

• Broken access control

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request t…

• Broken access control

Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to query slave upgrade status and affect upgrade bookkeeping via sending…

• Broken access control

Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain pairing and mesh-slave configuration via sending a crafted POST req…

• Broken access control

Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803.

• Server-side request forgery (SSRF)

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.

• Hard-coded credentials

D-Link DIR-825M LTE Module Firmware Upgrade formLtefotaUpgradeFibocom sub_41802C stack-based overflow

• D-Link DIR-825M
• Memory corruption

D-Link DIR-825M Disk Formatting Handler Endpoint formDiskFormat sub_46725C stack-based overflow

• D-Link DIR-825M
• Memory corruption

SiYuan before v3.8.1 Stored XSS via block name

• siyuan
• Cross-site scripting (XSS)

SiYuan before v3.8.1 Stored XSS via confirmDialog

• siyuan
• Cross-site scripting (XSS)

AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token

• WWBN AVideo
• Weak cryptography or TLS

Tenda HG10 Boa Web Server formIPv6Routing buffer overflow

• Tenda HG10
• Memory corruption

TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruption

• TOTOLINK A720R
• Memory corruption

MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token

• TangibleWP MyHome Core
• CWE-289

Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout

• Addify Custom User Registration Fields for WooCommerce
• Privilege escalation

Rodauth before 2.46.0 Authentication Bypass via webauthn_login

• jeremyevans rodauth
• Authentication bypass

Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown

• coderaiser cloudcmd
• Path traversal

argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP

• argoproj-labs argocd-mcp
• CWE-1327

Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in

• omnivore
• Weak cryptography or TLS

rust-iot-platform Authentication Bypass via Missing Request Guards

• iot-ecology rust-iot-platform
• Authentication bypass

Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

• Shinobi
• Hard-coded credentials

Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field

• bdthemes SigmaForms Pro – AI Generated Forms
• Unrestricted file upload

net: gro: properly validate BIG TCP aggregation criteria

• Linux kernel

Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password

• 爱采集数据采集和发布插件
• Server-side request forgery (SSRF)

Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure

• Total processing card payments for WooCommerce
• Server-side request forgery (SSRF)

Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation

• Uix UserCenter
• Privilege escalation

Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator

• MemberHero
• Privilege escalation

Multiple Vulnerabilities in IBM Concert Software

• IBM Concert
• SQL injection

Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

• IBM Langflow OSS
• Code injection

Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

• IBM Langflow OSS
• Code injection

IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].

• IBM Administration Runtime Expert for i
• Authentication bypass

Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

• SQL injection
• Code injection

<12.3.10 || >=2026.1.0, <2026.1.6 · fixed in 12.3.10, 2026.1.6

Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

• Insecure deserialization

<12.3.10 || >=2026.1.0, <2026.1.6 · fixed in 12.3.10, 2026.1.6

plone.app.event vulnerable to denial of service via iCalendar import

• Denial of service

<5.2.4 || >=6.0.0a1, <6.0.1 · fixed in 5.2.4, 6.0.1

Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference

• NousResearch hermes-agent
• CWE-494

plone.app.portlets vulnerable to denial of service via RSS feed portlet

• Denial of service

<5.0.8 || >=6.0.0, <6.0.4 || >=7.0.0, <7.0.2 · fixed in 5.0.8, 6.0.4, 7.0.2

Potential authentication bypass leading to administrative access in Artifactory

• jfrog artifactory
• Authentication bypass

JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values

• shriyanss js-recon
• Command injection

Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

• Code injection

>=5.13.0, <5.13.2 || <5.12.8 · fixed in 5.13.2, 5.12.8

Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)

• Code injection

>=5.13.0, <5.13.2 || <5.12.8 · fixed in 5.13.2, 5.12.8

Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

• Code injection

>=5.13.0, <5.13.2 || <5.12.8 · fixed in 5.13.2, 5.12.8

free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

• CWE-20

<4.2.2 · fixed in 4.2.2

Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

• Memory corruption

<1.7.19 · fixed in 1.7.19

Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

• Memory corruption
• Race condition

<1.7.19 · fixed in 1.7.19

Kotaemon Missing Ownership Check in Conversation Functions

• Cinnamon kotaemon
• Broken access control

Argo Rollouts Dashboard Unauthenticated Mutating Operations

• argoproj argo-rollouts
• Authentication bypass

Redpanda Admin API Unauthenticated Superuser Access via Default Configuration

• redpanda
• Authentication bypass

Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true

• kubeflow pipelines
• Broken access control
• Server-side request forgery (SSRF)

PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

• PaperCut MF/NG
• Code injection

PaperCut MF/NG: Authentication Bypass

• PaperCut MF/NG
• CWE-305

Budibase before 3.41.3 Remote Code Execution via Plugin eval()

• budibase server
• Code injection

WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability

• Liquid Web / StellarWP GiveWP
• Insecure deserialization

Use after free in Open-Xchange GmbH OX Dovecot Pro and others

• Open-Xchange GmbH OX Dovecot Pro
• Open-Xchange GmbH OX Dovecot CE
• Memory corruption

OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default

• Eclipse Foundation Eclipse Lyo
• Broken access control

Cross-site scripting in Synology Chat Server

• Synology Chat Server
• Cross-site scripting (XSS)

ipvs: do not propagate one-packet flag to synced conns

• Linux kernel

net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller

• Linux kernel

idpf: bound interrupt-vector register fill to the allocated array

• Linux kernel

KVM: s390: pci: Fix NULL dereference on AIBV allocation failure

• Linux kernel

vxlan: re-fetch eth header after route_shortcircuit()

• Linux kernel