A stack-based buffer overflow vulnerability exists in certain ASUS Router firmware versions. This flaw allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges by sending a crafted device name. The vulnerability is identified as CVE-2026-84730 and has a high severity rating with a CVSS 4.0 score of 8.7. No specific affected versions or patch information are provided in the available data.
CVE-2026-112116 is a vulnerability in the ASUS System Control Interface where an exposed IOCTL with insufficient access control allows a local, low-privileged user to read and write arbitrary physical memory. This flaw can lead to a complete compromise of the affected system. The vulnerability affects versions from 3.1.66.0 through 3.1.69.0 inclusive. It has a high severity score of 8.5 according to CVSS 4.0. No public exploits or patches are currently documented in the provided data.
CVE-2026-110464 is a missing authorization vulnerability in ASUS Armoury Crate affecting versions 5.4.10 through 6.5.14. It allows a local attacker with limited privileges to write content to specific files or registry locations with Local System privileges or cause a recoverable system crash via the service's exposed inter-process interface. The vulnerability has a medium severity score of 6.9.
CVE-2026-121610 is a SQL injection vulnerability in funadmin version 7.1.0. It affects the Curd::selectList function in the /frontend/ajax/index file of the Frontend List Endpoint component. The vulnerability arises from improper handling of the selectFields argument, allowing remote attackers to execute SQL injection attacks. Public exploit code is available, and the vendor has not responded to disclosure attempts.
CVE-2026-121609 is a critical vulnerability in Qihoo 360 Whole Home Router M5 version 4.0.17.1566. It involves hard-coded credentials in the boot script component, specifically in the Home function of /etc/init.d/mpt. This flaw allows remote attackers to exploit the device without any privileges or user interaction. Public exploit code is available, increasing the risk of exploitation. The vendor has not responded to disclosure attempts, and no patch information is provided.
CVE-2026-121608 is an OS command injection vulnerability in Qihoo 360 D603-2, D600-2, and D606-6 devices running firmware up to version 6.3.2. The flaw exists in the on_push_message function of the /fs2/bin/iscm component, specifically in the Timezone Push Handler, where manipulation of the tz argument can lead to remote command execution. The vulnerability is remotely exploitable and has been publicly disclosed. Firmware version 6.4.0 includes a fix by adding a validation check for the timezone parameter, mitigating the issue.
The yzx-npm package versions 1.0.0 and 1.0.1 contain malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone may not eliminate all malicious components, as the attacker may have established persistent control.
CVE-2026-121607 is a critical OS command injection vulnerability in Qihoo 360 devices D603-2, D600-2, D606-6, and D706 up to version 6.4.9. The flaw exists in the testspeed_command function within the /fs2/bin/iscm file, where manipulation of the host argument allows remote attackers to execute arbitrary OS commands. The vulnerability has a maximum CVSS 4.0 score of 10.0, indicating severe impact. Public exploit code is available, but there is no vendor response or patch released at this time.
The npm package 'mocha-ui-themes' contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the system, potentially exposing all stored secrets and keys. Immediate removal of the package is advised, but due to the severity of the compromise, simply removing the package may not eliminate all malicious software. Secrets and keys should be rotated from a different, trusted machine.
CVE-2026-121606 is a critical vulnerability in Qihoo 360 devices including models D621-2, D603-2, D600-2, D619, D606-6, and D706 running firmware versions 6.4.0 through 6.4.9. The flaw exists in the Firmware Signature Verification component, specifically in the verify_sign function, where improper verification of cryptographic signatures occurs due to manipulation of the signature argument. This vulnerability can be exploited remotely without any privileges or user interaction. Public exploit code has been disclosed, but the vendor has not responded or issued a fix.
CVE-2026-121600 is a critical stack-based buffer overflow vulnerability in TOTOLINK A950RG version 4.1.2cu.5268_B20221104. The flaw exists in the setMacFilterRules function within the /cgi-bin/cstecgi.cgi file, specifically in the MAC Filter Handler component. Remote attackers can exploit this vulnerability by manipulating the addEffect argument. Public exploit code is available, increasing the risk of exploitation.
Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds,
identifies, and reports environment data, or facts, such as the number of physical and virtual
systems on a network, their operating systems, and relevant configuration data stored within
them. Discovery also identifies and reports more detailed facts for some versions of key
Red Hat packages and products that it finds in the network.
CVE-2026-92198 is an XML External Entity (XXE) vulnerability in the getSource method of Quest Foglight for Databases. It allows remote attackers to cause the XML parser to access arbitrary URIs and disclose information without authentication. This can lead to sensitive data exposure in the context of the application.
CVE-2026-92195 is a directory traversal vulnerability in the loadEvolveLicense script of Quest Foglight for Databases. It allows authenticated remote attackers to execute arbitrary code with SYSTEM privileges by exploiting improper validation of user-supplied paths in file operations. The vulnerability has a high severity score of 8.8 and does not currently have a known exploit in the wild. No specific affected versions or patches are provided.
CVE-2026-92196 is a server-side template injection vulnerability in Quest Foglight for Databases affecting the renderTemplateString method. It allows authenticated remote attackers to execute arbitrary code with SYSTEM privileges due to improper validation of user-supplied input before template processing. The vulnerability has a high severity rating with a CVSS score of 7.2.
CVE-2026-92194 is a high-severity vulnerability in Quest Foglight for Databases involving a directory traversal flaw in the loadManageServerLicense script. This flaw allows authenticated remote attackers to execute arbitrary code with SYSTEM privileges by exploiting improper validation of user-supplied paths in file operations.
CVE-2026-92197 is a high-severity vulnerability in Quest Foglight for Databases involving a directory traversal flaw in the unzipFile method. This flaw allows authenticated remote attackers to execute arbitrary code with SYSTEM privileges by exploiting improper validation of user-supplied file paths.
CVE-2026-92200 is a local privilege escalation vulnerability in Quest Foglight for Databases caused by incorrect permission assignment on a folder used by the product installer. An attacker with the ability to execute low-privileged code locally can exploit this flaw to escalate privileges and execute arbitrary code with SYSTEM-level permissions.
CVE-2026-92193 is a medium severity vulnerability in Quest Foglight for Databases affecting the FileServlet component. It allows authenticated remote attackers to disclose sensitive file path information due to improper validation of user-supplied paths. This flaw can lead to information disclosure with SYSTEM-level context.
CVE-2026-92199 is a local privilege escalation vulnerability in Quest Foglight for Databases caused by a hard-coded cryptographic key in the symmetricDecrypt method. An attacker with low-privileged code execution can exploit this flaw to escalate privileges to SYSTEM level and execute arbitrary code. The vulnerability has a high CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability.