A critical vulnerability exists in Qihoo 360 Whole Home Router M5 version 4.0.17.1566. The flaw is in the Boot Script component, specifically the Home function of /etc/init.d/mpt, which leads to hard-coded credentials. This vulnerability allows remote attackers to exploit the device without authentication. Public exploit code is available, increasing the risk of exploitation. The vendor was notified but has not responded or provided a fix.
A critical stack-based buffer overflow vulnerability exists in the TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104. The flaw is in the strcpy function within /cgi-bin/cstecgi.cgi, specifically in the Basic Wireless Configuration Handler component when processing the 'wepkey' argument. This vulnerability can be exploited remotely without user interaction and has a public exploit disclosed.
A local, low-privileged user can exploit an exposed IOCTL interface in the ASUS System Control Interface due to insufficient access control. This vulnerability allows arbitrary read and write access to physical memory via crafted device control requests, potentially leading to complete system compromise.
A critical vulnerability exists in Qihoo 360 devices D621-2, D603-2, D600-2, D619, D606-6, and D706 up to firmware version 6.4.9. The flaw resides in the verify_sign function of the Firmware Signature Verification component, allowing improper verification of cryptographic signatures due to manipulation of the sign argument. This vulnerability can be exploited remotely and has publicly disclosed exploit code. The vendor has not responded to disclosure attempts, and no patch information is available.
A critical stack-based buffer overflow vulnerability exists in the TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104, specifically in the setMacFilterRules function of the MAC Filter Handler component. This flaw can be exploited remotely via manipulation of the addEffect argument. Public exploit code is available, and the vulnerability has a CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.
In the bootloader download module, there is a possible out-of-bounds write due to a failure to reset a global offset variable during firmware update sessions. This could lead to heap memory corruption, system crash, or potential arbitrary code execution with no additional execution privileges needed.
In Modem Firmware, there is a possible system crash due to improper input validation of dedicated PUCCH configuration. This could lead to remote denial of service with no additional execution privileges needed.
CVE-2026-121618 is an information disclosure vulnerability in the Linksys E5600 router version 1.1.0.26. The flaw exists in the /cgi-bin/fqc.cgi component related to Factory Quality Control. It allows remote attackers to disclose information without authentication. Public exploit code is available. The affected product is no longer supported by the vendor, and no patch or vendor response has been provided.
Airbyte has a vulnerability that permits arbitrary code execution due to improper class loading of unintended components. No specific affected versions or patch information are provided.
Multiple products from Akeeba Ltd. have been identified with a cross-site request forgery (CSRF) vulnerability. No specific affected versions or detailed technical information are provided. There is no indication of active exploitation or available patches at this time.
The w002yardprobe RubyGem contains malicious code that executes during YARD documentation generation. It runs a script that collects host identifiers and exfiltrates them to a third-party URL. The script also modifies files in the build environment and leaves sentinel files indicating its activity. The malicious behavior triggers when documentation is generated, affecting developer workstations, CI runners, or documentation hosting services that process the gem's docs.
CVE-2026-121617 is a high-severity vulnerability in the Linksys E5600 router version 1.1.0.26. It involves an out-of-bounds write flaw in the init_multipart function within the /cgi-bin/upload_fw.cgi component's Header Parser. This vulnerability can be exploited remotely without authentication and has publicly available exploit code. The affected product is no longer supported by the vendor, and no patch or official response has been provided.
CVE-2026-121802 is a critical vulnerability in better-auth's Better Auth package versions before 1.7.16. It involves an origin validation error (CWE-346) where the software signs a caller-supplied state value without verifying if it was issued by the server. This flaw allows unauthenticated attackers to perform account takeover actions, such as changing any account's email address. The issue is fixed in version 1.7.16. After updating, the application secret must be rotated to ensure security.
CVE-2026-121616 is an out-of-bounds write vulnerability in the Linksys E5600 router firmware version 1.1.0.26. It occurs in the strcpy function within the /cgi-bin/mesh_login.cgi component's JSON Request Parser when processing certain arguments such as username, password, token, source, cn, or action. The vulnerability can be triggered remotely without authentication. Exploit code is publicly available. The affected product is no longer supported by the vendor, and no patch or vendor response has been provided.
CVE-2026-121615 is a critical improper authentication vulnerability in Linksys E5600 version 1.1.0.26. It affects an unknown function in the /cgi-bin/mesh_login.cgi login handler component. The flaw allows remote attackers to bypass authentication controls. The vulnerability has been publicly disclosed with exploit details available. The affected product is no longer supported by the vendor, and no response or patch has been provided.
CVE-2026-84729 is an out-of-bounds write vulnerability in certain ASUS Router firmware versions. This flaw allows an unauthenticated nearby attacker to write data beyond the intended buffer, potentially leading to denial-of-service (DoS) conditions via crafted packets. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.2. No specific affected versions or patch information are provided in the available data.