What needs attention now.

D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection

• D-Link DWR-M920
• Command injection

D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow

• D-Link DIR-878
• Memory corruption

D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow

• D-Link DIR-878
• Memory corruption

Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0

• regularlabs.com Conditional Content Pro extension for Joomla
• Code injection

D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow

• D-Link DIR-823G
• Memory corruption

Totolink A3002MU boa formPortFw buffer overflow

• Totolink A3002MU
• Memory corruption

Totolink A3002MU boa formNewSchedule buffer overflow

• Totolink A3002MU
• Memory corruption

Totolink A3002MU boa formIpv6Setup buffer overflow

• Totolink A3002MU
• Memory corruption

Totolink A3002MU boa formFilter buffer overflow

• Totolink A3002MU
• Memory corruption

CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router

• CryptoPayment Gateway
• Broken access control

LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

• LangBot
• CWE-331

Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

• strapi
• Cross-site scripting (XSS)

Tonec Internet Download Manager Kernel Driver idmwfp.sys access control

• Tonec Internet Download Manager
• Privilege escalation
• Broken access control

Improper certificate validation in Kalkitech ASE2000 V2 Communication Test Set

• Kalkitech ASE2000 V2 Communication Test Set
• Weak cryptography or TLS

sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers

• irontec sngrep
• Memory corruption

The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation

• stellarwp The Events Calendar
• Code injection

The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

• stellarwp The Events Calendar
• Insecure deserialization

WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update

• WP Component
• Privilege escalation

WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload

• WP images upload on piclect
• Unrestricted file upload

Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection

• Masteriyo LMS
• Insecure deserialization

DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload

• DS Ad Rotator
• Unrestricted file upload

WebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal

• WebTotem Backups
• Path traversal

Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal

• CODE MONKEYS PROPOSALS
• Path traversal

Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse

• Frontegg SAML SSO
• Authentication bypass

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

• GitLab
• Path traversal

Deserialization of Untrusted Data in GitLab

• GitLab
• Insecure deserialization

yayson: Prototype pollution in Store/LegacyStore deserialization

• Prototype pollution

<4.3.0 · fixed in 4.3.0

Use of default credentials in Malcolm

• CISA Malcolm
• CWE-1392

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

• Hard-coded credentials

<0.84.0 · fixed in 0.84.0

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

• Authentication bypass
• CWE-346

<0.4.2 · fixed in 0.4.2

NFSD: check truncate permission under inode lock

• Linux kernel

NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

• Linux kernel

nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

• Linux kernel

nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

• Linux kernel

nfsd: size fh_verify server sockaddr slot by xpt_locallen

• Linux kernel

nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

• Linux kernel

nfsd: don't free session slots that are still in use

• Linux kernel

nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

• Linux kernel

nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

• Linux kernel

nfsd: fix layout fence worker double-reference race

• Linux kernel

nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()

• Linux kernel

nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

• Linux kernel

nfsd: fix UAF in async copy cancel and shutdown

• Linux kernel

nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget

• Linux kernel

nfsd: gate nfs2 setacl by argp->mask

• Linux kernel

nfsd: gate nfs3 setacl by argp->mask

• Linux kernel

nfsd: initialize copy-notify stateid before publishing it

• Linux kernel

NFSD: Prevent lock owner use-after-free during client teardown

• Linux kernel

NFSD: Prevent client use-after-free during admin state revocation

• Linux kernel

NFSD: Prevent client use-after-free during delegation revoke

• Linux kernel

NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup

• Linux kernel

libceph: reject buckets with mismatched CRUSH ids

• Linux kernel

ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock

• Linux kernel

ceph: fix UAF in check_new_map() on session freed during unlock

• Linux kernel

ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode

• Linux kernel

ceph: bound copied dentry name length in NFS export get_name

• Linux kernel

ceph: bound MDSCapAuth path and fs_name decode in handle_session()

• Linux kernel

ceph: bound num_export_targets array for mds info v2/v3

• Linux kernel

ceph: bound xattr value length in __build_xattrs()

• Linux kernel

audit: avoid dropping live tree ref on fsnotify rule autoremove

• Linux kernel