Vulnerability Threats

Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrent_helper.cc, which allows a remote malicious user to cause a Denial of Service

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3.

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in version 3.2.3.

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert functionality. This issue has been fixed in version 3.2.3.

In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.

A code execution vulnerability exists in the D-Link DI-7001 MINI_5G firmware version 19.10.31A1. The flaw is in the 'flag' parameter of the msp_info component and allows an attacker to execute arbitrary commands. No patch or remediation information is currently available. There is no evidence of exploitation in the wild to date.

CVE-2026-78541 is a stored OS command injection vulnerability in the parent-control module of TP-Link Archer BE3600 v1. An authenticated attacker with administrative access on the local network can store a crafted profile name containing shell metacharacters. This input is later processed unsafely during daily cloud report generation, potentially allowing arbitrary command execution on the device. Exploitation could impact device confidentiality, integrity, and availability.

CVE-2026-78417 is a vulnerability in Devolutions Remote Desktop Manager's IronVNC client that allows insufficient verification of data authenticity. This affects versions 2026.2.17.0 and earlier, and 2026.1.24.0 and earlier. The flaw permits an on-path attacker to intercept and tamper with VNC sessions by exploiting automatic acceptance of the server's RSA key during RSA-AES authentication.

CVE-2026-75371 is an integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software. This vulnerability allows attackers with physical proximity and UART access to cause a Denial of Service (DoS) by sending crafted input. No patch or official remediation information is currently available. There is no evidence of active exploitation in the wild. The affected software versions are not explicitly stated.

CVE-2026-75370 is an out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC software. This flaw allows an attacker to cause a Denial of Service (DoS) by supplying a specially crafted CAN message. No patch or official remediation information is currently available. There is no CVSS score assigned to this vulnerability, and no known exploits in the wild have been reported.