Category
Network devices
11,125 known vulnerabilities.
160 results · Clear filters · Feed
-
High 7.5
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an al…
KEV Nov 6, 2026 -
High 8.8CVE-2026-107441 Public exploit
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 co…
-
High 8.5CVE-2026-105810 Public exploit
Authenticated Local Stack Overflow in TP-Link Tapo C320WS
Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can submit a crafted request containing an oversized encrypted password field, overwrite…
-
High 8.5
PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by thi…
KEV Oct 14, 2026 -
High 8.1CVE-2026-97205 Public exploit
NGINX ngx_http_core_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a U…
-
High 8.1CVE-2026-15176 Public exploit
NGINX ngx_http_core_module vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achi…
-
High 8.6
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute ar…
KEV Oct 13, 2026 -
High 7.2CVE-2026-102257 Public exploit
A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extra…
-
High 7.8CVE-2026-102256 Public exploit
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerab…
-
High 7.1CVE-2026-104944 Public exploit
Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500
TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service co…
-
High 8.8CVE-2026-88778 Public exploit
TCP Initial Sequence Number (ISN) prediction
Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-…
-
High 8.8CVE-2026-88777 Public exploit
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and befor…
-
High 8.8CVE-2026-88776 Public exploit
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and befor…
-
High 8.8CVE-2026-88775 Public exploit
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 l…
-
High 7.0CVE-2026-88774 Public exploit
Feature policy bypass due to improper HTTP URL based expression usage
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feat…
-
High 8.8CVE-2026-94036 Public exploit
D-Link DIR-X1860/DIR-X1860Z routerd ubus access control
A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwd_set results in improper access co…
-
High 8.8CVE-2026-89020 Public exploit
MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path Leading to Privilege Escalation
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 5…
-
High 8.7CVE-2026-67281 Public exploit
Unauthenticated file read in Mikrotik RouterOS
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that…
-
High 7.8
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerab…
KEV Sep 2, 2026 -
High 8.5CVE-2026-16348 Public exploit
Command Injection Vulnerability in VPN connection of Archer BE800
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitatio…
-
High 8.7CVE-2026-9254 Public exploit
Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices
An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can in…
-
High 7.7CVE-2026-15469 Public exploit
Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800
The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol fo…
-
High 8.5CVE-2026-75616 Public exploit
Command Injection in Router Web Management Interface
An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary …
-
High 8.7CVE-2026-15315 Public exploit
Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200
Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls a…
-
High 8.6
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload une…
KEV Aug 11, 2026 -
High 8.8CVE-2026-20200 Public exploit
Cisco Integrated Management Controller Argument Injection and Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. T…
-
High 7.2CVE-2026-6837 Public exploit
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware version…
-
High 7.2CVE-2026-6952 Public exploit
A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-…
-
High 8.1CVE-2026-42533 Public exploit
NGINX Map directive and Regex matching vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achiev…
-
High 7.2
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the …
KEV Jul 14, 2026 -
High 7.5CVE-2026-20217 Public exploit
ClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerability
A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to impro…
-
High 8.7CVE-2026-11834 Public exploit
Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers
A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplyi…
-
High 8.1CVE-2026-42530 Public exploit
NGINX Open-Source ngx_http_v3_module vulnerability
NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session…
-
High 8.1CVE-2026-42055 Public exploit
NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_hea…
-
High 8.5CVE-2026-9151 Public exploit
Command Injection Vulnerability in OpenVPN on Multiple TP-Link Archer Routers
An OS command injection vulnerability exists in the VPN module of TP-Link Archer AX12 v1, AX17 v1. AX18 v1, and AX1300 v1.6 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a speci…
-
High 7.8
Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability
A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute…
KEV Jun 9, 2026 -
High 8.6
Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks thr…
KEV Jun 25, 2026 -
High 8.7CVE-2026-8697 Public exploit
Improper Authentication Rate Limiting on TP-Link's Archer C64
Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts and uses the same credentials as the web interface. This enables an attacker to brute-force valid cre…
-
High 8.1
NGINX ngx_http_rewrite_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/…
-
High 8.6CVE-2026-20224 Public exploit
Cisco Catalyst SD-WAN Manager XML External Entity Injection Vulnerability
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in an affected system. The attacker does not need to have valid user credentials. …