Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
400,551 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2014-125131 | 5.1 Medium | DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php | Oct 20, 2026 |
| CVE-2012-20005 | 5.1 Medium | SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter | Oct 20, 2026 |
| CVE-2012-20004 | 5.1 Medium | K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter | Oct 20, 2026 |
| CVE-2012-20003 | 5.1 Medium | Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php | Oct 20, 2026 |
| CVE-2012-20002 | 8.7 High | TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php | Oct 20, 2026 |
| CVE-2026-107929 | 8.1 High | local interface connection reuse mixup | Oct 20, 2026 |
| CVE-2026-111758 | 7.5 High | markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) | Oct 20, 2026 |
| CVE-2026-107928 | 8.1 High | info leak uploading over WebSockets with GnuTLS | Oct 20, 2026 |
| CVE-2026-105960 | 6.8 Medium | HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Inconsistency | Oct 20, 2026 |
| CVE-2026-94266 | 7.5 High | password leak in CURLINFO_EFFECTIVE_URL | Oct 20, 2026 |
| CVE-2026-110322 | 6.8 Medium | HMS Networks PEAK-System PCAN Windows drivers Untrusted Pointer Dereference | Oct 20, 2026 |
| CVE-2026-94265 | 9.1 Critical | Authorization: Negotiate sent to foreign origin | Oct 20, 2026 |
| CVE-2026-35499 | 9.1 Critical | An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can… | Oct 20, 2026 |
| CVE-2026-40627 | 9.1 Critical | An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can… | Oct 20, 2026 |
| CVE-2026-28763 | 9.1 Critical | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution.… | Oct 20, 2026 |
| CVE-2026-41223 | 9.1 Critical | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An… | Oct 20, 2026 |
| CVE-2026-33568 | 9.1 Critical | A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An… | Oct 20, 2026 |
| CVE-2026-41222 | 9.1 Critical | A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An… | Oct 20, 2026 |
| CVE-2026-40615 | 9.1 Critical | A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code… | Oct 20, 2026 |
| CVE-2026-42020 | 9.1 Critical | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An… | Oct 20, 2026 |
| CVE-2026-42019 | 9.1 Critical | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An… | Oct 20, 2026 |
| CVE-2026-42024 | 9.1 Critical | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to… | Oct 20, 2026 |
| CVE-2026-42023 | 9.1 Critical | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to… | Oct 20, 2026 |
| CVE-2026-42022 | 9.1 Critical | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to… | Oct 20, 2026 |
| CVE-2026-42021 | 9.1 Critical | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to… | Oct 20, 2026 |
| CVE-2026-42026 | 9.1 Critical | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary… | Oct 20, 2026 |
| CVE-2026-42025 | 9.1 Critical | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary… | Oct 20, 2026 |
| CVE-2026-9660 | 9.1 Critical | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code… | Oct 20, 2026 |
| CVE-2026-9659 | 9.1 Critical | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code… | Oct 20, 2026 |
| CVE-2026-9814 | 9.1 Critical | An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker… | Oct 20, 2026 |
| CVE-2026-9817 | 9.1 Critical | A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker… | Oct 20, 2026 |
| CVE-2026-9827 | 9.1 Critical | A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can… | Oct 20, 2026 |
| CVE-2026-9869 | 9.1 Critical | A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An… | Oct 20, 2026 |
| CVE-2026-10131 | 9.1 Critical | An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker… | Oct 20, 2026 |
| CVE-2026-10132 | 9.1 Critical | A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker… | Oct 20, 2026 |
| CVE-2026-10133 | 9.1 Critical | A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make… | Oct 20, 2026 |
| CVE-2026-10135 | 9.1 Critical | A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an… | Oct 20, 2026 |
| CVE-2026-10136 | 9.1 Critical | A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker… | Oct 20, 2026 |
| CVE-2026-10137 | 9.1 Critical | A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker… | Oct 20, 2026 |
| CVE-2026-10138 | 9.1 Critical | A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make… | Oct 20, 2026 |
| CVE-2026-10139 | 9.1 Critical | A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an… | Oct 20, 2026 |
| CVE-2026-10141 | 9.1 Critical | A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can… | Oct 20, 2026 |
| CVE-2026-92391 | 7.5 High | curl_mime_free stack overflow by recursion | Oct 20, 2026 |
| CVE-2026-103672 | 6.9 Medium | HMS Networks PEAK-System PCAN Windows drivers Improper Validation of Array Index | Oct 20, 2026 |
| CVE-2026-92390 | 7.5 High | -J no-clobber guarantee bypassed with 103 early hints | Oct 20, 2026 |
| CVE-2026-92389 | 8.1 High | TFTP direction confusion | Oct 20, 2026 |
| CVE-2026-92388 | 9.1 Critical | FTP wildcard write callback mixup | Oct 20, 2026 |
| CVE-2026-92387 | 8.1 High | never-ending loop via server response omission | Oct 20, 2026 |
| CVE-2026-101103 | 6.8 Medium | HMS Networks PEAK-System PCAN Windows drivers Classic Buffer Overflow | Oct 20, 2026 |
| CVE-2026-92386 | 8.1 High | server-set cookie aborts cookie jar load | Oct 20, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.