Vuldb Updates

A vulnerability, which was classified as critical, was found in GNU inetutils up to 2.7. This affects the function add_slc of the component telnetd. Such manipulation leads to buffer overflow. This vulnerability is documented as CVE-2026-32746. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in asbplayer 1.13.0 and classified as critical. Impacted is an unknown function of the component Subtitle File Handler. Such manipulation leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2025-69771. The attack can be launched remotely. No exploit exists.

A vulnerability, which was classified as critical, has been found in siteboon claude-code-ui. Affected by this issue is some unknown functionality of the component Websocket Handler. The manipulation leads to os command injection. This vulnerability is documented as CVE-2026-31975. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability categorized as critical has been discovered in qhkm zeptoclaw up to 0.7.5. The impacted element is an unknown function of the file /webhook. Executing a manipulation of the argument sender/chat_id can lead to missing authentication. The identification of this vulnerability is CVE-2026-32231. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability labeled as problematic has been found in xtemos WoodMart Plugin up to 8.3.9 on WordPress. The affected element is an unknown function. Such manipulation leads to exposure of sensitive system information to an unauthorized control sphere. This vulnerability is documented as CVE-2026-32405. The attack can be executed remotely. There is not any exploit available.

A vulnerability marked as critical has been reported in Bogdan Bendziukov Squeeze Plugin up to 1.7.7 on WordPress. This affects an unknown function. The manipulation leads to path traversal: '.../...//'. This vulnerability is listed as CVE-2026-32415. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in IBM Sterling B2B Integrator up to 6.1.2.7_2/6.2.0.5_1/6.2.1.1_1/6.2.2.0. It has been rated as problematic. Impacted is an unknown function. Performing a manipulation results in insertion of sensitive information into sent data. This vulnerability is known as CVE-2025-14483. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

A vulnerability marked as problematic has been reported in hexpm hex.pm. This vulnerability affects unknown code. Performing a manipulation results in resource consumption. This vulnerability is identified as CVE-2026-23940. The attack can be initiated remotely. There is not any exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability identified as problematic has been detected in tolgee tolgee-platform up to 3.166.2. Affected by this vulnerability is an unknown functionality of the component XML Parser. This manipulation causes xml external entity reference. The identification of this vulnerability is CVE-2026-32251. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability was found in BoldGrid Client Invoicing by Sprout Invoices Plugin up to 20.8.9 on WordPress and classified as critical. Affected is an unknown function. The manipulation results in improper control of filename for include/require statement in php program ('php remote file inclusion'). This vulnerability is cataloged as CVE-2026-32401. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in gVectors wpDiscuz up to 7.6.46. Affected by this issue is some unknown functionality of the component CSS Setting Handler. The manipulation of the argument customCss leads to cross site scripting. This vulnerability is listed as CVE-2026-22209. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability marked as critical has been reported in Linksys E4200, E3200, E3000, E2500, E2100L, E2000, E1550, E1500, E1200, E1000 and E900. This affects an unknown function of the file /tmUnblock.cgi of the component Service Port 8080. Performing a manipulation of the argument ttcp_ip results in os command injection. This vulnerability is known as CVE-2025-34037. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

A vulnerability marked as critical has been reported in QNAP QuNetSwitch 2.0.4.0415. This impacts an unknown function. The manipulation leads to hard-coded credentials. This vulnerability is uniquely identified as CVE-2026-22900. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in QNAP QVR Pro 2.7.4.14. This affects an unknown function. Executing a manipulation can lead to missing authentication. This vulnerability is handled as CVE-2026-22898. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

A vulnerability categorized as critical has been discovered in TP-Link AX53. This impacts an unknown function. Executing a manipulation can lead to command injection. This vulnerability appears as CVE-2025-15607. The attacker needs to be present on the local network. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability classified as critical has been found in Tenda A18 Pro 02.03.02.28. This issue affects the function setSchedWifi of the file /goform/openSchedWifi. This manipulation causes stack-based buffer overflow. This vulnerability is registered as CVE-2026-4490. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability classified as critical was found in Tenda A18 Pro 02.03.02.28. Impacted is the function fromSetIpMacBind of the file /goform/SetIpMacBind. Such manipulation of the argument list leads to stack-based buffer overflow. This vulnerability is documented as CVE-2026-4491. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability was found in TP-Link AX53. It has been classified as critical. The affected element is an unknown function. This manipulation causes stack-based buffer overflow. This vulnerability is registered as CVE-2025-15608. The attack requires access to the local network. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in DooTask 1.6.27. It has been rated as problematic. This affects an unknown function of the file /manage/project/. Performing a manipulation of the argument projectDesc results in cross site scripting. This vulnerability is reported as CVE-2026-29828. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability, which was classified as critical, has been found in Tenda A18 Pro 02.03.02.28. The affected element is the function set_qosMib_list of the file /goform/formSetQosBand. Performing a manipulation of the argument list results in stack-based buffer overflow. This vulnerability is reported as CVE-2026-4492. The attack is possible to be carried out remotely. Moreover, an exploit is present.