Baza CVE
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Totolink | CVE-2026-9660 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to… |
9,1 | 0,51 % | Brak wpisu w KEV nie wyklucza ataków | |
| Totolink | CVE-2026-9814 An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this… |
9,1 | 1,6 % | Brak wpisu w KEV nie wyklucza ataków | |
| Totolink | CVE-2026-9817 A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this… |
9,1 | 0,51 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-92386 When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely… |
8,1 | 0,83 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-92387 By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle. |
8,1 | 1,05 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-92388 When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate… |
9,1 | 0,7 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-92389 libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,… |
8,1 | 0,72 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-92390 When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an… |
7,5 | 0,59 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-92391 A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host… |
7,5 | 1,17 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-86415 libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option… |
7,5 | 0,42 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-87861 When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused. |
9,1 | 0,68 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-87862 Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS. |
8,1 | 1 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-87863 An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During… |
8,1 | 0,83 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-87864 Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP… |
8,1 | 0,83 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-87865 When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback. |
7,4 | 0,6 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-87866 When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -… |
9,1 | 0,51 % | Brak wpisu w KEV nie wyklucza ataków | |
| Totolink | CVE-2026-42020 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger… |
9,1 | 0,74 % | Brak wpisu w KEV nie wyklucza ataków | |
| Totolink | CVE-2026-42021 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated… |
9,1 | 0,48 % | Brak wpisu w KEV nie wyklucza ataków | |
| Totolink | CVE-2026-42022 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated… |
9,1 | 0,48 % | Brak wpisu w KEV nie wyklucza ataków | |
| Totolink | CVE-2026-42023 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated… |
9,1 | 0,51 % | Brak wpisu w KEV nie wyklucza ataków | |
| Totolink | CVE-2026-42024 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated… |
9,1 | 0,51 % | Brak wpisu w KEV nie wyklucza ataków | |
| Totolink | CVE-2026-42025 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP… |
9,1 | 0,51 % | Brak wpisu w KEV nie wyklucza ataków | |
| Totolink | CVE-2026-42026 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP… |
9,1 | 0,51 % | Brak wpisu w KEV nie wyklucza ataków | |
| curl | CVE-2026-86414 An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`. |
9,1 | 0,68 % | Brak wpisu w KEV nie wyklucza ataków | |
| Totolink | CVE-2026-28763 A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to… |
9,1 | 0,74 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 15:09 UTC – 13.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.