Category
Network devices
11,278 known vulnerabilities.
3,907 results · Clear filters · Feed
-
High 8.6
Cisco IOS XR Software Security Hardening Release: September 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple int…
-
High 8.2
Cisco IOS XR Software Security Hardening Release: September 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple int…
-
High 8.1
NGINX ngx_http_js_module vulnerablility
Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externa…
-
High 7.5
NGINX ngx_http_js_module vulnerability
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: …
-
High 8.3
NGINX Ingress Controller vulnerability
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sa…
-
High 8.1
NGF vulnerability
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom …
-
High 8.2
NGINX ngx_http_js_module vulnerability
Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial …
-
High 8.8
BIG-IP and BIG-IQ Configuration utility vulnerability
BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI). Impact: This vulnerability may allow an authenticated attacker wi…
-
High 7.8
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerab…
KEV Sep 2, 2026 -
High 8.8
D-Link DSM-G600 Multipart load_file.cgi out-of-bounds write
A weakness has been identified in D-Link DSM-G600 1.01. This affects an unknown function of the file /load_file.cgi of the component Multipart Handler. Executing a manipulation can lead to out-of-bounds write. The attack may be launched remotely. The exploit …
-
High 7.4
D-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injection
A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injecti…
-
High 8.7
http_gdpr_decrypt Pre-Authentication Stack-Based Buffer Overflow
A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to…
-
High 8.7
Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices
Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauth…
-
High 8.8
A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-en…
-
High 8.2
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Conn…
-
High 7.0
The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allow…
-
High 8.8
A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to…
-
High 8.5
Command Injection in Parent Control of TP-Link Archer BE3600 v1
A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later process…
-
High 8.5CVE-2026-16348 Public exploit
Command Injection Vulnerability in VPN connection of Archer BE800
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitatio…
-
High 8.7CVE-2026-9254 Public exploit
Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices
An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can in…
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vul…
-
High 7.2
DrayTek VigorSwitch Multiple Models Buffer Overflow via mail_mailalert
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size.…
-
High 7.2
DrayTek VigorSwitch Multiple Models Buffer Overflow via diag_logmail
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A…
-
High 7.2
DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Edit ACE
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger thi…
-
High 7.2
DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Add ACE
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this…
-
High 7.2
DrayTek VigorSwitch Multiple Models Buffer Overflow via switch_lan_gvrp
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this vulnerability via cr…
-
High 7.2
DrayTek VigorSwitch Multiple Models Buffer Overflow via poe_schedule_profile
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of the start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_…
-
High 7.2
DrayTek VigorSwitch Multiple Models Buffer Overflow via sysreboot
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker can trigger this vulnerability via craf…
-
High 7.2
DrayTek VigorSwitch Multiple Models Buffer Overflow via webBackupAction
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnerability is caused by repeated string concatenation of the pathN, valueN, key, and option fields into fixed-size stack buffers without total …
-
High 7.2
DrayTek VigorSwitch Multiple Models Buffer Overflow via pingtrace
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker …
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this vuln…
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this v…
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via setTime
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulne…
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vu…
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can tr…
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vul…
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vul…
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via getVid
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulner…
-
High 7.2
DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vuln…
-
High 7.5
DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi
Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerabil…