Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
111 results · page 1 of 3
Oct 19, 2026A security vulnerability has been detected in H3C Magic NX15 NX15V100R017.CVE-2026-112373 · Other software · H3C · reported by VulDBMedium 5.7
A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
- Product
- Magic NX15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026A weakness has been identified in H3C Magic NX15 V100R017.CVE-2026-112372 · Other software · H3C · reported by VulDBLow 2
A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
- Product
- Magic NX15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026A vulnerability was determined in H3C Magic NX15 NX15V100R017.CVE-2026-112371 · Other software · H3C · reported by VulDBHigh 8.6
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
- Product
- Magic NX15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026A vulnerability was found in H3C Magic NX15 100R017.CVE-2026-112370 · Other software · H3C · reported by VulDBHigh 8.6
A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
- Product
- Magic NX15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026A vulnerability was detected in H3C NX15 V100R017.CVE-2026-18902 · Other software · H3C · reported by VulDBHigh 7.3
A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
- Product
- NX15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026A security vulnerability has been detected in H3C NX15 V100R017.CVE-2026-18901 · Other software · H3C · reported by VulDBHigh 7.3
A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
- Product
- NX15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026A weakness has been identified in H3C NX15 V100R017.CVE-2026-18900 · Other software · H3C · reported by VulDBHigh 7.3
A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
- Product
- NX15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026A vulnerability was found in H3C NX15 V100R017.CVE-2026-18814 · Other software · H3C · reported by VulDBHigh 7.3
A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of the file /api/esps. The manipulation results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
- Product
- NX15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026A vulnerability has been found in H3C NX15 V100R017.CVE-2026-18813 · Other software · H3C · reported by VulDBHigh 7.3
A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipulation of the argument esps.apcm.version leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
- Product
- NX15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026A flaw has been found in H3C NX15 V100R017.CVE-2026-18812 · Other software · H3C · reported by VulDBHigh 7.3
A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
- Product
- NX15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026A vulnerability was detected in H3C NX15 V100R017.CVE-2026-18811 · Other software · H3C · reported by VulDBHigh 7.3
A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
- Product
- NX15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026A security vulnerability has been detected in H3C NX15 V100R017.CVE-2026-18810 · Other software · H3C · reported by VulDBMedium 6.9
A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure.
- Product
- NX15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NCVE-2025-29296 · Other software · reported by MITRECritical 9.8
H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The affected object interfaces and methods are esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modify), esps.apcm.version (delete, H3C Magic NX15 only), esps.swcm.version (delete, upgrade, all affected models except H3C Magic NX15), and esps.system.ntp (set, all affected models except H3C Magic NX15). Attacker-controlled request parameters are incorporated into shell expressions executed by eval without adequate validation, allowing a remote attacker to execute arbitrary commands as root and gain complete control of the affected device.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2026A vulnerability was found in H3C NX15 V100R017.CVE-2026-15479 · Other software · H3C · reported by VulDBMedium 5.5
A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak password recovery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
- Product
- NX15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows CVE-2026-61459 · Other software · Flux159 · reported by VulnCheckCritical 9.3
MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.
- Product
- mcp-server-kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management.CVE-2026-47250 · Other software · Flux159 · reported by GitHubMedium 6.1
mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.7.0, the kubectl_generic tool in mcp-server-kubernetes passes user-supplied flags directly to kubectl without any allowlist, enabling a privilege escalation attack within Kubernetes environments. An attacker who already has limited cluster or codebase access, for example, a developer with pod-deployment permissions but not cluster-admin credentials, can plant a single structured JSON line in an application's log output. When an operator with a privileged kubeconfig uses the MCP server to read those logs and their AI agent follows the injected instruction, kubectl_generic is called with --server=https://attacker.example.com and --insecure-skip-tls-verify=true. kubectl sends all API requests, including the Authorization: Bearer <token> header from the operator's kubeconfig to the attacker's endpoint. The captured token can then be replayed directly against the real Kubernetes API server, granting the attacker the full RBAC permissions of the operator's service account. This issue has been patched in version 3.7.0.
- Product
- mcp-server-kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management.CVE-2026-46519 · Other software · Flux159 · reported by GitHubHigh 8.8
mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.6.0, mcp-server-kubernetes exposes three environment variables (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS) documented as access controls for restricting which Kubernetes operations are available. These controls are enforced at the tool discovery layer (tools/list) but not at the execution layer (tools/call). Any client that knows a tool name can invoke it directly regardless of the configured restriction mode. The access control was effectively cosmetic. This issue has been patched in version 3.6.0.
- Product
- mcp-server-kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/gueCVE-2026-10046 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.5
Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bios_handlers.c. The handler computes a destination offset into the guest RealModeMemory buffer from guest-controlled ES and EDI register values without validating that the resulting address remains within the 1MB RealModeMemory allocation. A malicious guest operating in real mode can trigger the issue by invoking INT 0x15 with AX=0xE820, EDX=0x534D4150, ECX greater than or equal to 20, EBX=0, ES=0xFFFF, and EDI=0xFFFF. This can cause a write of up to 20 bytes past the end of the RealModeMemory buffer into the hypervisor heap. The product is end-of-life and unsupported when assigned.
- Product
- Napoca bare-metal hypervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026A vulnerability was detected in Flux159 mcp-game-asset-gen 0.1.0.CVE-2026-7594 · Other software · Flux159 · reported by VulDBMedium 5.5
A vulnerability was detected in Flux159 mcp-game-asset-gen 0.1.0. Affected is the function image_to_3d_async of the file src/index.ts of the component MCP Interface. The manipulation of the argument statusFile results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mcp-game-asset-gen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management.CVE-2026-39884 · Other software · Flux159 · reported by GitHubHigh 8.3
mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior contain an argument injection vulnerability in the port_forward tool in src/tools/port_forward.ts, where a kubectl command is constructed via string concatenation with user-controlled input and then naively split on spaces before being passed to spawn(). Unlike all other tools in the codebase which correctly use array-based argument passing with execFileSync(), port_forward treats every space in user-controlled fields (namespace, resourceType, resourceName, localPort, targetPort) as an argument boundary, allowing an attacker to inject arbitrary kubectl flags. This enables exposure of internal Kubernetes services to the network by injecting --address=0.0.0.0, cross-namespace targeting by injecting additional -n flags, and indirect exploitation via prompt injection against AI agents connected to the MCP server. This issue has been fixed in version 3.5.0.
- Product
- mcp-server-kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis control daemon (chassisd) of Juniper Networks Junos OS on SRX1500, SRX4100,CVE-2026-33787 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 6.8
An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis control daemon (chassisd) of Juniper Networks Junos OS on SRX1500, SRX4100, SRX4200 and SRX4600 allows a local attacker with low privileges to cause a complete Denial of Service (DoS). When a specific 'show chassis' CLI command is executed, chassisd crashes and restarts which causes a momentary impact to all traffic until all modules are online again. This issue affects Junos OS on SRX1500, SRX4100, SRX4200 and SRX4600: * 23.2 versions before 23.2R2-S6, * 23.4 versions before 23.4R2-S7 * 24.2 versions before 24.2R2-S2, * 24.4 versions before 24.4R2, * 25.2 versions before 25.2R1-S1, 25.2R2.
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026OS Command Injection vulnerability in NEC Platforms, Ltd.CVE-2026-4620 · Other software · NEC Platforms, Ltd. · reported by psirt-info@cyber.jp.nec.comHigh 7.1
OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.
- Product
- Aterm WX1500HP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information.CVE-2026-24449 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.1
For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information.
- Product
- WRC-X1500GS-B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Cross-site request forgery vulnerability exists in ELECOM wireless LAN products.CVE-2026-20704 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.1
Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed.
- Product
- WRC-X1500GS-B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it.CVE-2025-66404 · Other software · Flux159 · reported by GitHubMedium 6.4
MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (sh -c) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent. This vulnerability is fixed in 2.9.8.
- Product
- mcp-server-kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below.CVE-2025-60854 · Other software · Dlink · reported by MITRECritical 9.8
A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change request in the web administrator page, it is possible to trigger a command injection in httpd.
- Product
- R15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.com
Oct 20, 2025GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgi that enables an attCVE-2018-25118 · Other software · GeoVision Inc. · reported by VulnCheckCritical 10
GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgi that enables an attacker to execute arbitrary commands on the device. The vulnerable models have been declared end-of-life (EOL) by the vendor. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-19 08:55:13.141502 UTC.
- Product
- GV-BX1500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025KV STUDIO and VT5-WX15/WX12 contain a stack-based buffer overflow vulnerability.CVE-2025-58775 · Other software · KEYENCE CORPORATION · reported by vultures@jpcert.or.jpHigh 8.4
KV STUDIO and VT5-WX15/WX12 contain a stack-based buffer overflow vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.
- Product
- KV STUDIO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials.CVE-2025-57295 · Other software · H3c · reported by MITREHigh 8
H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no password set, and the H3C user account uses the default password "admin," both stored in the /etc/shadow file. Attackers with network access can exploit these credentials to gain unauthorized root-level access to the device via the administrative interface or other network services, potentially leading to privilege escalation, information disclosure, or arbitrary code execution.
- Product
- Magic Nx15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025An issue in TP-Link AX10 Ax1500 v.1.3.10 Build (20230130) allows a remote attacker to obtain sensitive informationCVE-2025-29089 · Other software · reported by MITREHigh 7.5
An issue in TP-Link AX10 Ax1500 v.1.3.10 Build (20230130) allows a remote attacker to obtain sensitive information
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordintrix.com.aulinkedin.com
Sep 6, 2025An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500.CVE-2025-9961 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 8.6
An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500. The exploit can only be conducted via a Man-In-The-Middle (MITM) attack. This issue affects AX10 V1/V1.2/V2/V2.6/V3/V3.6: before 1.2.1; AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6: before 1.3.11.
- Product
- AX10 V1/V1.2/V2/V2.6/V3/V3.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.byteray.co.uktp-link.com
Aug 4, 2025A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injectingCVE-2025-26065 · Other software · Intelbras · reported by MITREHigh 7.3
A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a visiting Wi-Fi network.
- Product
- RX 1500 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanuais.intelbras.com.brmanuais.intelbras.com.br
Jul 31, 2025A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injectingCVE-2025-26064 · Other software · Intelbras · reported by MITREHigh 7.3
A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a connnected device.
- Product
- RX 1500 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanuais.intelbras.com.brmanuais.intelbras.com.br
Jul 31, 2025An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted payload into the ESSIDCVE-2025-26063 · Other software · Intelbras · reported by MITRECritical 9.8
An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted payload into the ESSID name when creating a network.
- Product
- RX 1500 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanuais.intelbras.com.brmanuais.intelbras.com.br
Jul 31, 2025An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file and obtain potentialCVE-2025-26062 · Other software · Intelbras · reported by MITRECritical 9.8
An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file and obtain potentially sensitive information from the current settings.
- Product
- RX 1500 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanuais.intelbras.com.brmanuais.intelbras.com.br
Jul 27, 2025A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105.CVE-2025-8246 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formRoute of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105.CVE-2025-8245 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAPVLAN of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105.CVE-2025-8244 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been classified as critical. Affected is an unknown function of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105 and classified as critical.CVE-2025-8243 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105 and classified as critical. This issue affects some unknown processing of the file /boafrm/formMapDel of the component HTTP POST Request Handler. The manipulation of the argument devicemac1 leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025A vulnerability has been found in TOTOLINK X15 1.0.0-B20230714.1105 and classified as critical.CVE-2025-8242 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability has been found in TOTOLINK X15 1.0.0-B20230714.1105 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument ip6addr/url/vpnPassword/vpnUser leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it.CVE-2025-53355 · Other software · Flux159 · reported by GitHubHigh 7.5
MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.execSync, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. This vulnerability is fixed in 2.5.0.
- Product
- mcp-server-kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025Intelbras RX1500 Router v2.2.17 and before is vulnerable to Incorrect Access Control in the FirmwareUpload function and GetFirmwareValidation function.CVE-2025-50405 · Other software · Intelbras · reported by MITREMedium 6.5
Intelbras RX1500 Router v2.2.17 and before is vulnerable to Incorrect Access Control in the FirmwareUpload function and GetFirmwareValidation function.
- Product
- RX 1500 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comintelbras.com
Jul 1, 2025Intelbras RX1500 Router v2.2.17 and before is vulnerable to Integer Overflow.CVE-2025-50404 · Other software · Intelbras · reported by MITREMedium 5.3
Intelbras RX1500 Router v2.2.17 and before is vulnerable to Integer Overflow. The websReadEvent function incorrectly uses the int type when processing the "command" field of the http header, causing the array to cross the boundary and overwrite other fields in the array.
- Product
- RX 1500 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comintelbras.com
Jun 28, 2025A vulnerability classified as critical has been found in TOTOLINK X15 up to 1.0.0-B20230714.1105.CVE-2025-6824 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in TOTOLINK X15 up to 1.0.0-B20230714.1105. Affected is an unknown function of the file /boafrm/formParentControl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2025A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105.CVE-2025-6402 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formIpv6Setup of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2025A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0.0-B20230714.1105.CVE-2025-6399 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0.0-B20230714.1105. Affected is an unknown function of the file /boafrm/formIPv6Addr of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2025A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105.CVE-2025-6165 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formTmultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20230714.1105.CVE-2025-6150 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105.CVE-2025-6146 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been classified as critical. This affects an unknown part of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2025A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20230714.1105.CVE-2025-5790 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20230714.1105. This vulnerability affects unknown code of the file /boafrm/formIpQoS of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.