VulDB Recent Entries

A vulnerability, which was classified as very critical, was found in D-Link DI-7001 MINI 19.10.31A1. This impacts the function msp_info. The manipulation of the argument flag results in os command injection. This vulnerability was named CVE-2025-26237. The attack may be performed from remote. There is no available exploit.

A vulnerability, which was classified as critical, has been found in HumanSignal Label Studio up to 1.23.0. This affects the function get_queryset of the file label_studio/tasks/api.py of the component Annotation Detail Endpoint. The manipulation leads to improper privilege management. This vulnerability is uniquely identified as CVE-2026-76073. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability classified as problematic was found in SpaceDot. The impacted element is the function cobs_decode. Executing a manipulation can lead to integer overflow. This vulnerability is handled as CVE-2026-75371. It is possible to launch the attack on the local host. There is not any exploit available. A patch should be applied to remediate this issue.

A vulnerability classified as very critical has been found in TP-Link Archer BE3600. The affected element is an unknown function of the component parent-control module. Performing a manipulation results in command injection. This vulnerability is known as CVE-2026-78541. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability described as critical has been identified in SpaceDot. Impacted is the function MessageParser::parseECSSTCHeader of the component MessageParser. Such manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2026-75370. The attack may be launched remotely. There is no exploit available. Applying a patch is advised to resolve this issue.

A vulnerability marked as critical has been reported in Devolutions Remote Desktop Manager up to 2026.2.17.0/2026.1.24.0. This issue affects some unknown processing of the component IronVNC client. This manipulation causes insufficient verification of data authenticity. This vulnerability appears as CVE-2026-78417. The attack may be initiated remotely. There is no available exploit.

A vulnerability labeled as critical has been found in oauth2-proxy OAuth2 Proxy up to 7.15.4. This vulnerability affects the function GetRequestURI of the file pkg/requests/util/util.go of the component Reverse-Proxy. The manipulation of the argument X-Forwarded-Uri results in improper access controls. This vulnerability is reported as CVE-2026-76835. The attack can be launched remotely. No exploit exists.

A vulnerability identified as critical has been detected in continuedev Continue up to 1.5.47. This affects the function isCriticalCommand of the file packages/terminal-security/src/evaluateTerminalCommandSecurity.ts of the component Bash Tool. The manipulation of the argument Home leads to permission issues. This vulnerability is documented as CVE-2026-76072. The attack can be initiated remotely. There is not any exploit available.

A vulnerability categorized as problematic has been discovered in Baserow prior 2.3.0. Affected by this issue is some unknown functionality of the file web-frontend/modules/core/editor/mention.js of the component Renderer. Executing a manipulation of the argument first_name can lead to cross site scripting. This vulnerability is registered as CVE-2026-76837. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in DrayTek VigorSwitch G2540xs, VigorSwitch P2540xs, VigorSwitch FX2120, VigorSwitch G2282x, VigorSwitch P2282x, VigorSwitch Q2300x, VigorSwitch PQ2300xb, VigorSwitch G2542x, VigorSwitch P2542x, VigorSwitch P2542xh, VigorSwitch PX2060, VigorSwitch G1280, VigorSwitch P1280, VigorSwitch P1281x, VigorSwitch G1282, VigorSwitch P1282, VigorSwitch G2121, VigorSwitch P2121, VigorSwitch PQ2121x, VigorSwitch Q2121x, VigorSwitch G2280x, VigorSwitch P2280x, VigorSwitch Q2200x, VigorSwitch PQ2200xb, VigorSwitch G2100, VigorSwitch P2100, VigorSwitch G2540x and VigorSwitch P2540x. It has been rated as very critical. Affected by this vulnerability is the function diag_logmail. Performing a manipulation results in buffer overflow. This vulnerability is cataloged as CVE-2026-71941. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in DrayTek VigorSwitch. It has been declared as very critical. Affected is the function acl_general_setup Edit ACE of the component Edit ACE. Such manipulation of the argument Name leads to buffer overflow. This vulnerability is listed as CVE-2026-71940. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in DrayTek VigorSwitch. It has been classified as very critical. This impacts the function acl_general_setup Add ACE function of the component Add ACE. This manipulation of the argument Name causes buffer overflow. This vulnerability is tracked as CVE-2026-71939. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in DrayTek VigorSwitch and classified as very critical. This affects the function mail_mailalert of the component Mail Alert. The manipulation results in buffer overflow. This vulnerability is identified as CVE-2026-71942. The attack can be executed remotely. There is not any exploit available.

A vulnerability has been found in DrayTek VigorSwitch G2540xs, VigorSwitch P2540xs, VigorSwitch FX2120, VigorSwitch G2282x, VigorSwitch P2282x, VigorSwitch Q2300x, VigorSwitch PQ2300xb, VigorSwitch G2542x, VigorSwitch P2542x, VigorSwitch P2542xh, VigorSwitch PX2060, VigorSwitch G1280, VigorSwitch P1280, VigorSwitch P1281x, VigorSwitch G1282, VigorSwitch P1282, VigorSwitch G2121, VigorSwitch P2121, VigorSwitch PQ2121x, VigorSwitch Q2121x, VigorSwitch G2280x, VigorSwitch P2280x, VigorSwitch Q2200x, VigorSwitch PQ2200xb, VigorSwitch G2100, VigorSwitch P2100, VigorSwitch G2540x and VigorSwitch P2540x and classified as very critical. The impacted element is the function setDevNet. The manipulation of the argument username/password leads to command injection. This vulnerability is referenced as CVE-2026-71943. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability, which was classified as problematic, was found in HiEventsDev Hi.Events 1.7.1-beta/1.11.0. The affected element is the function gethostbyname of the file backend/app/Validators/Rules/NoInternalUrlRule.php of the component NoInternalUrlRule. Executing a manipulation can lead to open redirect. The identification of this vulnerability is CVE-2026-76838. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in AzuraCast up to 0.23.8. Impacted is the function AbstractArrayEntity::fromArray of the file backend/src/Entity/Station.php of the component Liquidsoap Configuration. Performing a manipulation results in permission issues. This vulnerability was named CVE-2026-76836. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as problematic was found in Johnson Controls Metasys. This issue affects some unknown processing. Such manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-34491. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in GIMP. This vulnerability affects unknown code of the component file-pix. This manipulation causes out-of-bounds read. This vulnerability is handled as CVE-2026-78475. It is possible to launch the attack on the local host. There is not any exploit available.

A vulnerability described as very critical has been identified in DrayTek VigorSwitch G2540xs, VigorSwitch P2540xs, VigorSwitch FX2120, VigorSwitch G2282x, VigorSwitch P2282x, VigorSwitch Q2300x, VigorSwitch PQ2300xb, VigorSwitch G2542x, VigorSwitch P2542x, VigorSwitch P2542xh, VigorSwitch PX2060, VigorSwitch G1280, VigorSwitch P1280, VigorSwitch P1281x, VigorSwitch G1282, VigorSwitch P1282, VigorSwitch G2121, VigorSwitch P2121, VigorSwitch PQ2121x, VigorSwitch Q2121x, VigorSwitch G2280x, VigorSwitch P2280x, VigorSwitch Q2200x, VigorSwitch PQ2200xb, VigorSwitch G2100, VigorSwitch P2100, VigorSwitch G2540x and VigorSwitch P2540x. This affects the function switch_lan_gvrp. The manipulation of the argument portList results in buffer overflow. This vulnerability is known as CVE-2026-71938. It is possible to launch the attack remotely. No exploit is available.

A vulnerability marked as very critical has been reported in DrayTek VigorSwitch G1280, VigorSwitch G1282, VigorSwitch G2100, VigorSwitch G2121, VigorSwitch G2280x, VigorSwitch G2282x, VigorSwitch G2540x, VigorSwitch G2540xs, VigorSwitch G2542x, VigorSwitch P1280, VigorSwitch P1281x, VigorSwitch P1282, VigorSwitch P2100, VigorSwitch P2121, VigorSwitch P2280x, VigorSwitch P2282x, VigorSwitch P2540x, VigorSwitch P2540xs, VigorSwitch P2542x, VigorSwitch P2542xh, VigorSwitch PQ2121x, VigorSwitch PQ2200xb, VigorSwitch PQ2300xb, VigorSwitch Q2121x, VigorSwitch Q2200x, VigorSwitch Q2300x and VigorSwitch PX2060. Affected by this issue is the function poe_schedule_profile. The manipulation of the argument start_date/start_time/duration_time/how_often/weekdays/monthly_date/cycle_duration leads to buffer overflow. This vulnerability is traded as CVE-2026-71937. It is possible to initiate the attack remotely. There is no exploit available.