Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
12,374 results · Feed
-
Medium 4.3
Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticat…
-
Medium 4.3
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…
-
High 7.5
Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentic…
-
Medium 4.3
Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…
-
Medium 4.3
Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke…
-
Medium 4.3
Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…
-
Medium 4.3
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…
-
Medium 4.3
Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke…
-
Medium 6.1
Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site n…
-
Critical 9.8
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override he…
-
High 7.5
An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of…
-
Critical 9.8
An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro …
-
High 7.5
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMe…
-
Medium 6.5
Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to r…
-
High 8.4
Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint
WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase t…
-
Medium 4.6
WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page
A Reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL.
-
High 8.6
Dimension SQL Injection in Scheduled Report
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sendin…
-
Medium 5.1
Dimension Stored XSS in Scheduled Report Task
A stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any ot…
-
Medium 6.3
WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting
WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force at…
-
Medium 5.3
Dimension Server-Side Request Forgery via Remote Backup Connection Test
A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.
-
Medium 5.1
Dimension Server-Side Request Forgery via Email Server Test Settings
A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.
-
High 8.6
Dimension SQL Injection in Log Viewer
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending spec…
-
Medium 5.1
Dimension Log Server Configuration Lock Bypass Vulnerability
WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directl…
-
Medium 4.8
Dimension Stored XSS via Trusted CA Certificate Configuration
A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully c…
-
High 8.7
Dimension Denial-of-Service
WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service.
-
Critical 9.3
WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs
WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged i…
-
High 8.6
Dimension SQL Injection in Audit Report
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending sp…
-
Medium 5.1
Dimension SSRF via FTP Server Test Connection
A server-side request forgery (SSRF) vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.
-
Medium 5.1
Dimension Blind SSRF via Database Test Connection Feature
A blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.
-
Medium 6.9
Dimension Business Logic Flaw Allows Chained Backend Object Operations
A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request.
-
Critical 9.1
Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker…
-
High 8.7
Fireware OS Pre-Authentication Out-of-Bounds Read in iked Allows Denial of Service (DoS)
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
-
Critical 9.3
Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution
A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
-
High 8.7
Fireware OS Integer Underflow in iked Allows Unauthenticated Denial of Service (DoS)
An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
-
High 8.7
Fireware OS Integer Underflow in Iked Allows Unauthenticated Denial of Service (DoS)
An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
-
Critical 9.3
Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint
A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
-
Critical 9.3
Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution
An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
-
Critical 9.3
Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
-
High 8.7
Fireware OS Pre-Authentication Double Free in iked Allows Denial of Service (DoS)
A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
-
High 8.7
Fireware OS Stack-Based Buffer Overflow in iked Allows Unauthenticated Denial of Service
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.