CVE Vulnerabilities - 14 October 2026

The D-Link DIR-868L router (firmware version 2.01b05) has a flaw that lets an attacker send a specially crafted request and cause the device to execute operating‑system commands. This can be done from...

The alt_auth add‑on in e107 versions before 2.3.7 lets a bad actor place malicious code into the username field, which is then run as a database command. This can let an unauthenticated user view or c...

The File Upload to Order WordPress plugin, versions before 1.1.4, allows a public user to delete files on the web server. This could let an attacker remove important files and take control of your sit...

Versions 1.9.7 through 1.10.4 of HestiaCP let a regular panel user add a malicious PATH entry when setting a custom document root. When the system runs a search, it uses that PATH and can run the atta...

The NetX Duo client may copy a server-provided cookie into a follow‑up TLS handshake message without checking its size. A malicious server can send an oversized cookie, causing the client to write bey...

If you run KEDA version 2.20.2 or earlier, a user who can manage resources in a single namespace can create special objects that cause KEDA to forward its own high‑privilege service account token to a...

Versions 4.1.0 through 4.2.0 of the F Prime framework's GenericHub component may accept an invalid port number from a remote packet. If the number is outside the expected range, the software can write...

The JTL‑WMS system accepts data from users and inserts it directly into a database query without checking it first. This could let a remote attacker add their own commands and view, change, or delete ...

The web manager for charitable groups allows anyone on the internet to send specially crafted data to a billing page, which the software adds directly into its database without checking it. This can l...

The web manager for charitable groups allows anyone on the internet to send a specially crafted request to the cadastro_cobranca.php page and cause the system to execute unintended database commands. ...

Versions of WeGIA before 3.8.6 let anyone send crafted web requests that run arbitrary database commands. An attacker could view or change billing records, credentials, or even erase tables, causing d...

Juniper's Junos OS and Junos OS Evolved web management interface (J-Web) can be tricked into running malicious code when a virtual domain is set up. An outside attacker could take control of the devic...

Versions of the e107 website system older than 2.3.7 leave the install.php script reachable after a normal setup. An attacker who can send a specially crafted request to that script can cause the web ...

If a Junos OS or Junos OS Evolved device has the J-Web web management interface turned on, anyone on the same network can connect to it without a password and gain full administrative control. This me...

The Cisco Secure Email Gateway can be tricked by an outside attacker to place files anywhere on the server it runs on. This could let the attacker take control of the system or disrupt email services....

If BMP route monitoring is enabled, a malicious BGP neighbor can overflow a buffer in the routing daemon and execute any command with full system privileges. This could let an attacker take control of...

Juniper Networks' Junos OS running on SRX firewalls can be attacked when a GRE tunnel is set up. A specially crafted network packet can let an outside attacker run commands with full system privileges...

Juniper's Junos OS and Junos OS Evolved can be forced to stop working if a network device that talks to them sends specially crafted routing information while the BGP Monitoring feature is turned on. ...

The XPress-DR and XPress-DR-I network devices let anyone on the network send special UDP packets to read or overwrite the device's settings, including its IP address. This can be done without a passwo...