Critical severity threats

CVE-2026-121600 is a critical stack-based buffer overflow vulnerability in TOTOLINK A950RG version 4.1.2cu.5268_B20221104. The flaw exists in the setMacFilterRules function within the /cgi-bin/cstecgi.cgi file, specifically in the MAC Filter Handler component. Remote attackers can exploit this vulnerability by manipulating the addEffect argument. Public exploit code is available, increasing the risk of exploitation.

Red Hat Discovery is a tool that inspects and reports environment data about Red Hat product usage across networks. The advisory describes it as a subscription management tool but does not specify any particular vulnerability or exploit affecting it. The vendor advisory explicitly states that no fixes are currently available for the listed CVEs, including CVE-2026-8932, and does not provide mitigation steps. The advisory also references multiple CVEs affecting related components but does not confirm active exploitation or patch availability. The overall impact and technical details for CVE-2026-8932 are not detailed beyond the general description of the tool.

StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher contain a vulnerability that allows an attacker with product-specific knowledge and network access to certain Grid Network ports to make unauthorized requests. This vulnerability has a critical severity rating with a CVSS score of 9.1. No public exploits or patches are currently documented.

A critical out-of-bounds write vulnerability exists in the WebGL component of Google Chrome on Android versions prior to 156.0.8078.47. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by convincing a user to visit a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

The Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability. This flaw allows remote attackers to authenticate using factory-default credentials over unencrypted HTTP, gaining full Administrator access. Exploitation enables attackers to access complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, resulting in unauthorized administrative control of the charging station.

A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.

A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument wepkey leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-121597 is a critical stack-based buffer overflow vulnerability in TOTOLINK A950RG version 4.1.2cu.5268_B20221104. It affects the Easy Setup Wizard Handler component, specifically the setAppEasyWizardConfig function in /cgi-bin/cstecgi.cgi. The flaw arises from improper handling of the functionType argument, allowing remote attackers to trigger a buffer overflow. Public exploit code is available, increasing the risk of exploitation.

FreeRDP versions before 3.32.2 contain a use-after-free vulnerability in the client's rdpgfx dynamic virtual channel. This occurs when a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which is freed without clearing. A malicious RDP server can exploit this by opening and closing such a channel and then sending a PDU on the original channel, potentially causing a client crash or code execution.

FreeRDP versions before 3.32.2 contain an out-of-bounds write vulnerability in the proxy component. This occurs because the function rdp_read_bitmap_cache_v2_capability_set only rejects numCellCaches values above 5, but the bitmap cache v2 cell array is accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches, leading to heap corruption, potential data leakage, or a crash.

On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management and access controls are not enforced device-side. Thus, an unauthenticated user can change administrator-level settings (without logging in) via a modified client that bypasses the login step or via a custom client to make the underlying administrator API calls. This allows unauthenticated users to perform administrative actions too such as exporting configuration files that include the internal device credentials for the administrator user and other network systems.

Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the writeTopologySectionToFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29169.

Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ForgeMBeanServerSupport module. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29168.

Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the baseRmiServiceExporter bean. The issue results from the lack of proper validation of user-supplied data prior to deserializing it. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29170.

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685.