CVE Vulnerabilities - 20 September 2026

The DIR-868L router’s login handling script can be tricked into overflowing its memory when a specially crafted username or password is sent. This flaw lets an attacker run their own code on the devic...

Recent updates address several flaws in Firefox that could let a malicious website or code run with more rights than intended, potentially escaping security sandboxes or taking control of the browser....

Git Large File Storage may follow a shortcut (symbolic link) that is swapped out while it is walking through a directory, allowing an attacker to cause the program to read or write unintended files. T...

The Git Large File Storage tool on openeuler can be tricked into following a changed symbolic link while scanning directories, allowing an attacker to replace or create files they control. This could ...

The web management page of the Comfast CF-N1-S router (version 2.6.0.1) contains a coding error that lets a remote user send specially crafted data and overflow the program’s memory. This can cause th...

The FreeRDP remote‑desktop client shipped with openEuler can crash if it receives specially crafted data from a rogue RDP server. This can cause a denial of service, disrupting users who rely on remot...

The Linux kernel used in openeuler can crash when Bluetooth tries to cancel a pending connection because it may try to use a missing data pointer. This can cause the system to stop responding. Update ...

The OpenEuler operating system kernel had code that could let a program read or use memory that had already been released, potentially leading to crashes or data exposure. This issue is fixed in the l...

Certain versions of Mozilla Thunderbird (including 140.15, 153.2, and 155) have bugs that could let a malicious email or web content break out of its protected environment and run code on your compute...

The POCO library used in ROS Melodic can miscalculate the size of certain text data, causing a memory overflow that could let an attacker run code or crash the system. This problem exists in the curre...

The POCO library used in ROS Melodic can miscalculate the size of certain Unicode data, leading to an overflow on the program’s memory stack. This could allow an attacker to crash the application or e...

The POCO library used in ROS Melodic may miscalculate the size of certain text data, leading to a memory overflow. This can cause the application to crash or potentially be taken over by an attacker. ...

The python‑templated‑dictionary library used by the Mock build tool can execute text templates without enough protection. If a low‑privilege user supplies a crafted configuration, the template can cau...

The python-templated-dictionary package used by the Mock build tool expands configuration text using a template system. If an untrusted user can supply that text, they could cause the program to run c...

Versions of FreeIPMI earlier than 1.6.19 can be tricked into overwriting memory when they process certain responses from server hardware, which could cause the program to stop working or allow an atta...

The FreeIPMI tools used for remote console and system management on openEuler can be tricked into writing or reading beyond their memory limits when they receive malformed data from server hardware. T...

Versions of the openeuler exiv2 library up to 0.28.8 can incorrectly read or write data beyond the intended memory area, especially when processing remote image URLs. This could cause the program to c...

Versions of the openeuler exiv2 library up to 0.28.8 may read or write past the allocated memory when processing image files accessed via a web address. This could cause the program to crash or allow ...

The exiv2 library (versions 0.28.8 and earlier) may read or write outside its memory boundaries, especially when handling image files from a URL. This could cause the program to crash or be tricked in...

The exiv2 image metadata library (versions 0.28.8 and earlier) can read outside its allocated memory and, in some cases, write beyond its buffer when processing images from a URL. This could let an at...

The REDCap system (version 13.3.0 and later) can be tricked into running any code an attacker provides, without needing a login, by sending specially crafted requests to a public survey link. This cou...

The Caddy web server (cleanstart/caddy) contains a flaw that may let an attacker interfere with its encrypted connections or perform unauthorized actions. This could expose data or disrupt your servic...

The Caddy web server package may contain a weakness that could let attackers interfere with its secure communications. This could affect any system running Caddy, potentially exposing data or services...

The Caddy web server from cleanstart is affected by a flaw that could let attackers view or alter information that should be protected. This is important because the server handles encrypted traffic b...

The Caddy web server package has a weakness that could allow a remote user to bypass its built‑in encryption and view or alter data. This could expose private information or allow unauthorized changes...