Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
402 results · page 1 of 9
Sep 8, 2026Heap-based buffer overflow in Telnet Client allows an unauthorized attacker to execute code over a network.CVE-2026-69431 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Heap-based buffer overflow in Telnet Client allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Telnet service enablement CVE-2026-51664 · Other software · reported by MITREMedium 4.3
Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Telnet service enablement status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-49255 · Other software · electerm · reported by GitHubHigh 8.8
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, and a victim can cause that filename to reach the affected operation during remote-to-local transfer, conflict renaming, copying, moving, or removal. The generated `rm -rf`, mv, `cp -r`, PowerShell Remove-Item, Move-Item, or Copy-Item command can then interpret the filename as shell syntax. This allows arbitrary command execution with the electerm desktop user's privileges on POSIX and Windows systems, enabling data exfiltration, file modification, malware installation, or denial of service. This issue is fixed in version 3.11.11.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-49253 · Other software · electerm · reported by GitHubHigh 7.1
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. In src/app/server/zmodem.js, prepareReceiveFile() joins the filename to the user-selected save path, and in src/app/server/trzsz.js, getUniqueFilePath(), the openSaveFile() callback, and the savedFilePaths mapping construct destinations without sanitization. A malicious SSH server or remote shell can provide a filename containing traversal components such as ../escaped.txt or ../../.bashrc. When the victim accepts the transfer and selects a download directory, electerm can write outside that directory and overwrite files accessible to the desktop user, potentially changing sensitive configuration or impairing availability. This issue is fixed in version 3.11.11.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access.CVE-2026-67966 · Other software · reported by MITRECritical 9.8
Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-73227 · Other software · electerm · reported by GitHubHigh 8.1
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-controlled content outside the selected save directory because the RDP clipboard download path in src/client/components/rdp/file-transfer.js passes the server-controlled CLIPRDR filename fileInfo.name to osResolve without sanitization. This issue is fixed in version 3.15.120.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-73226 · Other software · electerm · reported by GitHubHigh 8.8
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-73225 · Other software · electerm · reported by GitHubHigh 8.1
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to write attacker-controlled content outside the selected download directory because recursive transfers in src/client/components/file-transfer/transfer.jsx pass server-supplied file.name and folder.name values to resolve without sanitization. This issue is fixed in version 3.15.120.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-73224 · Other software · electerm · reported by GitHubHigh 8.8
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This issue is fixed in version 3.15.120.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-73223 · Other software · electerm · reported by GitHubHigh 8.1
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write attacker-controlled content outside the temporary directory because the server-controlled filename name used by editWithSystemEditor in src/client/components/sftp/file-item.jsx is interpolated into path.resolve without sanitization. This issue is fixed in version 3.15.120.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled.CVE-2026-66405 · Other software · ECOVACS ROBOTICS · reported by vultures@jpcert.or.jpHigh 8.7
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.
- Product
- DEEBOT PRO M1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jprobot.hellohas.co.jp
Aug 8, 2026MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allowsCVE-2026-71991 · Other software · MSI · reported by VulnCheckCritical 9.3
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the Telnet configuration interface to inject malicious commands and obtain root privileges on the underlying system.
- Product
- Radix AXE6600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2026MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows reCVE-2026-71990 · Other software · MSI · reported by VulnCheckCritical 9.3
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the SSH configuration interface to inject malicious commands and obtain root privileges on the underlying system.
- Product
- Radix AXE6600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121, contains hardcoded login credentials and has telnet enabledCVE-2026-10045 · Other software · Shenzhen Kangda Xin Intelligent Network Technology Co., Ltd · reported by cret@cert.orgCritical 9.8
Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121, contains hardcoded login credentials and has telnet enabled by default on WAN and LAN interfaces. These vulnerabilities allow attackers to read and write to memory, modify firmware stored in flash, inspect active connections, and view currently connected devices.
- Product
- DR300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrubenabreu.xyzrubenabreu.xyz
May 28, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-45787 · Other software · electerm · reported by GitHubMedium 6
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks. This vulnerability is fixed in 3.9.5.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-45353 · Other software · electerm · reported by GitHubCritical 9.3
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-45058 · Other software · electerm · reported by GitHubCritical 9.4
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In 3.8.8 and earlier, there is persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject exec* fields or global config to cause remote code to run when a bookmark is opened or when sync is applied.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2026PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and CVE-2026-48851 · Other software · PuTTY · reported by MITRELow 3.1
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
- Product
- PuTTY
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.tartarus.orgchiark.greenend.org.uk
May 12, 2026Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.CVE-2026-35423 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-43944 · Other software · electerm · reported by GitHubCritical 9.4
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-43943 · Other software · electerm · reported by GitHubHigh 7.8
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or "Edit with custom editor" feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization. A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user's privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network. This issue has been patched in version 3.7.9.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-43942 · Other software · electerm · reported by GitHubMedium 5.5
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessible from any JavaScript running in the renderer (e.g., via the DevTools console or a compromised webview context). An attacker who achieves any JavaScript execution within the renderer can trivially exfiltrate these secrets to a remote server, leading to cloud account compromise, supply chain attacks, and lateral movement. At time of publication, there are no publicly available patches.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-43941 · Other software · electerm · reported by GitHubCritical 9.6
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, Electerm's terminal hyperlink handler passes any URL clicked in the terminal directly to shell.openExternal without any protocol validation. An attacker who controls terminal output (e.g., via a malicious SSH server, compromised remote host, or malicious plugin rendering terminal content) can thus achieve arbitrary code execution or local file access on the victim's machine, requiring only that the victim clicks a displayed link. At time of publication, there are no publicly available patches.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-43940 · Other software · electerm · reported by GitHubHigh 8.4
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.16, the runWidget function in src/app/widgets/load-widget.js constructs a file path by directly concatenating user‑supplied widget identifiers without any sanitisation. Because runWidget is exposed to the renderer process via an asynchronous IPC handler with no input validation, an attacker who achieves JavaScript execution inside the renderer (for example, through a malicious plugin or a cross‑site scripting flaw in the built‑in webview) can abuse a path traversal (../) to load and execute an arbitrary JavaScript file anywhere on the victim’s filesystem. This gives the attacker local code execution with the full privileges of the electerm process, leading to complete system compromise. This issue has been patched in version 3.7.16.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-41501 · Other software · electerm · reported by GitHubCritical 9.8
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:130. The runLinux() function appends attacker-controlled remote version strings directly into an exec("rm -rf ...") command without validation. This issue has been patched in version 3.3.8.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.CVE-2026-41500 · Other software · electerm · reported by GitHubCritical 9.8
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:150. The runMac() function appends attacker-controlled remote releaseInfo.name directly into an exec("open ...") command without validation. This issue has been patched in version 3.3.8.
- Product
- electerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor.CVE-2026-42376 · Network & remote access · D-Link · reported by 33c584b5-0579-4c06-b2a0-8d8329fcab9cCritical 9.8
D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /etc/init0.d/S80telnetd.sh with the username "Alphanetworks" and the static password "whdrv01_dlob_dir456U" read from /etc/config/image_sign. The custom telnetd binary accepts a -u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.
- Product
- DIR-456U Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026D-Link DIR-600L Hardware Revision A1 (End-of-Life) contains a hardcoded telnet backdoor.CVE-2026-42375 · Network & remote access · D-Link · reported by 33c584b5-0579-4c06-b2a0-8d8329fcab9cCritical 9.8
D-Link DIR-600L Hardware Revision A1 (End-of-Life) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static password "wrgn35_dlwbr_dir600l" read from /etc/alpha_config/image_sign. The custom telnetd binary accepts a -u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.
- Product
- DIR-600L Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026D-Link DIR-600L Hardware Revision B1 (End-of-Life) contains a hardcoded telnet backdoor.CVE-2026-42374 · Network & remote access · D-Link · reported by 33c584b5-0579-4c06-b2a0-8d8329fcab9cCritical 9.8
D-Link DIR-600L Hardware Revision B1 (End-of-Life) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static password "wrgn61_dlwbr_dir600L" read from /etc/alpha_config/image_sign. The custom telnetd binary accepts a -u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.
- Product
- DIR-600L Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026D-Link DIR-605L Hardware Revision B2 (End-of-Life, EOL) contains a hardcoded telnet backdoor.CVE-2026-42373 · Network & remote access · D-Link · reported by 33c584b5-0579-4c06-b2a0-8d8329fcab9cCritical 9.8
D-Link DIR-605L Hardware Revision B2 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static password "wrgn76_dlwbr_dir605L" read from /etc/alpha_config/image_sign. The custom telnetd binary accepts a -u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.
- Product
- DIR-605L Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026D-Link DIR-605L Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor.CVE-2026-42372 · Network & remote access · D-Link · reported by 33c584b5-0579-4c06-b2a0-8d8329fcab9cHigh 8.8
D-Link DIR-605L Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /bin/telnetd.sh with the username "Alphanetworks" and the static password "wrgn35_dlwbr_dir605l" read from /etc/alpha_config/image_sign. The custom telnetd binary accepts a -u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.
- Product
- DIR-605L Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary command execution (e.g., starting telnetd),CVE-2026-35682 · Other software · Anviz · reported by ics-cert@hq.dhs.govHigh 8.8
Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary command execution (e.g., starting telnetd), resulting in root‑level access.
- Product
- Anviz CX2 Lite Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send an oversized or unexpected username inputCVE-2026-22321 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 5.3
A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send an oversized or unexpected username input. An overflow condition crashes the thread handling the login attempt, forcing the session to close. Because other CLI sessions remain unaffected, the impact is limited to a low‑severity availability disruption.
- Product
- FL SWITCH 2005
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Telnet/SSH access to trigger memory corruptCVE-2026-22320 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 6.5
A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Telnet/SSH access to trigger memory corruption by supplying unexpected or oversized filename input. Exploitation results in the corruption of the internal buffer, causing the CLI and web dashboard to become unavailable and leading to a denial of service.
- Product
- FL SWITCH 2005
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.CVE-2026-32772 · Other software · GNU · reported by MITRELow 3.4
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.
- Product
- inetutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Mar 13, 2026telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check wCVE-2026-32746 · Other software · GNU · reported by MITRECritical 9.8
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
- Product
- inetutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.gnu.orgopenwall.com
Mar 12, 2026A command injection vulnerability has been identified in the Telnet command-line interface (CLI) of TP-Link TL-MR6400 v5.3.CVE-2026-3841 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 8.5
A command injection vulnerability has been identified in the Telnet command-line interface (CLI) of TP-Link TL-MR6400 v5.3. This issue is caused by insufficient sanitization of data processed during specific CLI operations. An authenticated attacker with elevated privileges may be able to execute arbitrary system commands. Successful exploitation may lead to full device compromise, including potential loss of confidentiality, integrity, and availability.
- Product
- TL-MR6400 v5.3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Feb 27, 2026telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implCVE-2026-28372 · Other software · GNU · reported by MITREHigh 7.4
telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.
- Product
- inetutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.hadrons.orglists.gnu.org
Feb 18, 2026UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote CVE-2025-70998 · Other software · UTT · reported by MITRECritical 9.8
UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote attacker to gain root access via a crafted script.
- Product
- 810 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026AbsoluteTelnet 11.12 contains a denial of service vulnerability in the SSH2 username input field that allows local attackers to crash the application.CVE-2020-37166 · Other software · Celestial Software · reported by VulnCheckMedium 6.9
AbsoluteTelnet 11.12 contains a denial of service vulnerability in the SSH2 username input field that allows local attackers to crash the application. Attackers can overwrite the username field with a 1000-byte buffer, causing the application to become unresponsive and terminate.
- Product
- AbsoluteTelnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcelestialsoftware.netexploit-db.com
Feb 6, 2026AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name.CVE-2020-37165 · Other software · Celestial Software · reported by VulnCheckMedium 6.7
AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name. Attackers can generate a 2500-character payload and paste it into the license name field to trigger an application crash.
- Product
- AbsoluteTelnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcelestialsoftware.netexploit-db.com
Feb 6, 2026AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name.CVE-2020-37164 · Other software · Celestial Software · reported by VulnCheckMedium 6.7
AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name. Attackers can generate a 2500-character payload and paste it into the license entry field to trigger an application crash.
- Product
- AbsoluteTelnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcelestialsoftware.netexploit-db.com
Jan 30, 2026Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the box.CVE-2026-24714 · Network & remote access · NETGEAR · reported by vultures@jpcert.or.jpHigh 8.7
Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the box.
- Product
- NETGEAR products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026Mocha Telnet Lite for iOS 4.2 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the user configuration iCVE-2020-36995 · Other software · telnet-lite · reported by VulnCheckMedium 4.6
Mocha Telnet Lite for iOS 4.2 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the user configuration input. Attackers can overwrite the 'User' field with 350 bytes of repeated characters to trigger an application crash and prevent normal functionality.
- Product
- Mocha Telnet Lite for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapps.apple.comexploit-db.com
Jan 22, 2026Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability.CVE-2026-0778 · Other software · Enel X · reported by zdi-disclosures@trendmicro.comHigh 8.8
Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Enel X JuiceBox 40 charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the telnet service, which listens on TCP port 2000 by default. The issue results from the lack of authentication prior to allowing remote connections. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23285.
- Product
- JuiceBox 40
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating username and error report fCVE-2021-47765 · Other software · Celestialsoftware · reported by VulnCheckMedium 6.7
AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating username and error report fields. Attackers can trigger the crash by inserting 1000 characters into the username or email address fields, causing the application to become unresponsive.
- Product
- AbsoluteTelnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcelestialsoftware.netexploit-db.com
Jan 15, 2026AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating DialUp connection and licenCVE-2021-47764 · Other software · Celestialsoftware · reported by VulnCheckMedium 6.7
AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating DialUp connection and license name fields. Attackers can generate a 1000-character payload and paste it into specific input fields to trigger application crashes and force unexpected termination.
- Product
- AbsoluteTelnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcelestialsoftware.netexploit-db.com
Jan 8, 2026KAYSUS KS-WR1200 routers with firmware 107 expose SSH and TELNET services on the LAN interface with hardcoded root credentials (root:12345678).CVE-2025-68718 · Other software · Kaysus · reported by MITREMedium 5.4
KAYSUS KS-WR1200 routers with firmware 107 expose SSH and TELNET services on the LAN interface with hardcoded root credentials (root:12345678). The administrator cannot disable these services or change the hardcoded password. (Changing the management GUI password does not affect SSH/TELNET authentication.) Any LAN-adjacent attacker can trivially log in with root privileges.
- Product
- Ks-wr1200 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet serCVE-2026-22542 · Other software · EFACEC · reported by 50b5080a-775f-442e-83b5-926b5ca517b6Critical 9.2
An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet service.
- Product
- QC 60/90/120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, CVE-2020-36915 · Other software · Adtecdigital · reported by VulnCheckHigh 8.7
Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level access and execute system commands across multiple Adtec Digital product versions.
- Product
- SignEdje Digital Signage Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.compacketstorm.news
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.