Threat database

A vulnerability exists in the handling of CURLOPT_INTERFACE (or the command line tool's --interface option) when set with certain prefixes (if!, host!, ifhost!). The binding to the source interface is not included in the connection reuse key, allowing a later transfer requesting a different source to reuse an existing connection and send traffic from the earlier transfer's source address.

An OS command injection vulnerability exists in the boa formUpload() functionality of TOTOLINK X2000R firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. This vulnerability allows an authenticated attacker to execute arbitrary code by sending a specially crafted HTTP request. The vulnerability has a high severity with a CVSS score of 9.1, indicating critical impact on confidentiality, integrity, and availability.

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of the TOTOLINK X2000R device (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). This vulnerability allows an authenticated attacker to execute arbitrary code by sending a specially crafted HTTP request. The vulnerability has a high severity with a CVSS score of 9.1.

A stack-based buffer overflow vulnerability exists in the batchupg functionality of TOTOLINK X2000R firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. An authenticated attacker can trigger this vulnerability via a specially crafted HTTP request, potentially leading to arbitrary code execution. The vulnerability has a critical severity with a CVSS score of 9.1.

A critical stack-based buffer overflow vulnerability exists in the formUpload() functionality of the TOTOLINK X2000R router firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. This flaw can be triggered by an authenticated HTTP request, potentially allowing arbitrary code execution with high impact on confidentiality, integrity, and availability.

An OS command injection vulnerability exists in the batchupg functionality of TOTOLINK X2000R firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. This vulnerability allows an authenticated attacker to execute arbitrary code by sending a specially crafted HTTP request. The vulnerability has a critical CVSS score of 9.1, indicating high impact on confidentiality, integrity, and availability.

A logic flaw in the curl command line tool causes SSH host verification options to be applied only when directly using SFTP or SCP protocols, but not when these protocols are accessed via redirects. This means that when curl follows a redirect to an SFTP or SCP resource, the SSH host verification options are not enforced as expected.

This vulnerability involves an ftp:// transfer configured with CURLUSESSL_NONE reusing a pooled FTP control connection previously upgraded with STARTTLS and authenticated with a client certificate. The second FTP handle does not perform a new TLS handshake or FTP login, causing the server to continue authorizing it under the first handle's certificate identity.

CVE-2026-86409 describes a vulnerability where setting the CURLOPT_AWS_SIGV4 option to NULL does not disable AWS Signature Version 4 (SigV4) authentication as expected. Instead, subsequent HTTP transfers on the same handle continue to send an Authorization header using AWS4-HMAC-SHA256, potentially leaking authentication state information to unintended URLs.

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On subsequent curl invocations using the same cookie jar path, curl fails before connecting and replaces the cookie jar with an empty file, deleting cookies for unrelated domains.

CVE-2026-86413 is a vulnerability in curl where using an ambient user for Negotiate authentication combined with following redirects could cause curl to send credential details to an unrelated second origin during a redirect.

A stored Cross-Site Scripting (XSS) vulnerability exists in the SNS enrollment Portal. An attacker can inject malicious scripts through the captive portal when requesting certificate creation for a user. The stored XSS payload is triggered only during validation by an administrator. This vulnerability has a high severity rating with a CVSS score of 7.0.

A medium-severity vulnerability (CVE-2026-113643) exists in EspoCRM versions up to 9.3.10 and 10.0.10. It affects the ImageSourceProvider::get function in the PDF Rendering Pipeline component, allowing remote attackers with limited privileges to bypass authorization by manipulating an argument ID. The vulnerability does not impact confidentiality, integrity, or availability beyond limited information disclosure. A patch identified by commit 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2 is available to address this issue.

A stored Cross-Site Scripting (XSS) vulnerability exists in the SNS enrollment Portal. An attacker can inject malicious scripts through the captive portal during user creation requests. The stored XSS payload is triggered only during validation by an administrator. This vulnerability has a high severity rating with a CVSS score of 7.1.

A stored Cross-Site Scripting (XSS) vulnerability has been identified in the SNS VPN log monitoring screen. This vulnerability allows an attacker with low privileges to inject malicious scripts that are stored and later executed in the context of users viewing the log monitoring screen. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No information about affected versions or available patches is provided.

Crypt::Age versions before 0.004 for Perl contain a vulnerability that allows CPU exhaustion via an unbounded number of recipient stanzas. The header parser accepts any number of recipient stanzas, and the unwrap_file_key function performs expensive cryptographic operations for each stanza and identity before rejecting the file. This can lead to denial of service by exhausting CPU resources during decryption attempts of files not written by the caller.

CVE-2026-91668 is a high-severity vulnerability in Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access to exploit SQL to compromise the product, potentially resulting in full takeover. The vulnerability affects confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has released patches for this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).