Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

2,031 alerts · page 19 of 102

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-121600 TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflow

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: totolink a950rg firmware

    A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEffect causes stack-based buffer overflow....

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-121599 TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: totolink a950rg firmware

    A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in sta...

  3. Critical (CVSS 9+) Published

    CVE-2026-121598 TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: totolink a950rg firmware

    A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument wepkey leads to stack-based buffer overf...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-121597 TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: totolink a950rg firmware

    A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument functionType can lead to stack-based bu...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-39430 On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management and access controls are not enforced device-side. Thus, an unauthenticated user c...

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management and access controls are not enforced device-side. Thus, an unauthenticated user can change administrator-level settings (without logging in) via a modified clien...

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-92189 Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Quest Foglight for Databases

    Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not require...

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-92188 Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Quest Foglight for Databases

    Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to explo...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-92190 Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Quest Foglight for Databases

    Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not require...

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-114549 NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability

    CriticalCVSS 9.8 EPSS 0.58%

    Exploit status: No public exploit known

    Affects: NoMachine

    NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exist...

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-120647 CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename

    CriticalCVSS 9.8 EPSS 0.52%

    Exploit status: No public exploit known

    Affects: azure linux perl-CGI, debian/libcgi-pm-perl, redhat/perl-CGI and 1 more

    CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header(-attachment => $name) writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An ap...

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-120644 CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values

    CriticalCVSS 9.1 EPSS 0.42%

    Exploit status: No public exploit known

    Affects: azure linux perl-CGI, debian/libcgi-pm-perl, redhat/perl-CGI and 1 more

    CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets t...

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-120642 CGI versions before 5.00 for Perl return request-derived values untainted under taint mode

    CriticalCVSS 9.1 EPSS 0.42%

    Exploit status: No public exploit known

    Affects: azure linux perl-CGI, debian/libcgi-pm-perl, redhat/perl-CGI and 1 more

    CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the name lists from url_param and cookie are returned without the taint flag, as is a coo...

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-120637 CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: redhat/perl-CGI, cpan CGI

    CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_...

  14. Critical (CVSS 9+) Published · updated

    CVE-2026-22058 CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: netapp StorageGRID (formerly StorageGRID Webscale)

    StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests.

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-120931 chromium-browser: Out of bounds write in WebGL

    CriticalCVSS 9.6

    Exploit status: No public exploit known

    Affects: Google Chrome

    Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

  16. Critical (CVSS 9+) Published · updated

    CVE-2026-119084 Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters

    CriticalCVSS 9.2

    Exploit status: No public exploit known

    Affects: AWS amazon-redshift-jdbc-driver

    Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided...

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-112354 Etrel INCH AC Charging Station Hard-coded Default Credentials

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: Etrel d.o.o. Etrel INCH

    Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers...

  18. Critical (CVSS 9+) Published

    CVE-2026-82158 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker wit...

    CriticalCVSS 9.0 EPSS 0.35%

    Exploit status: No public exploit known

    Affects: Dell Wyse Management Suite

    Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script...

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-121073 chromium-browser: Use after free in Network

    CriticalCVSS 9.6

    Exploit status: No public exploit known

    Affects: Google Chrome

    Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low)

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-121189 Chromium CVE-2026-121189: Use after free

    CriticalCVSS 9.6 EPSS 0.41%

    Exploit status: No public exploit known

    Affects: Microsoft edge chromium, debian/chromium, Google Chrome

    Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).