Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
28078
Total
2162
Critical
8456
High
8753
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-46246 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler Using the `devm_` variant for … | Jun 03, 2026 |
| CVE-2026-46245 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dc_link NULL handling in HPD init amdgpu_dm_hpd_init() may see connectors without a valid … | Jun 03, 2026 |
| CVE-2026-46244 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly … | Jun 03, 2026 |
| CVE-2026-40290 | HIGH | 7.8 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting … | Jun 03, 2026 |
| CVE-2026-39107 | MEDIUM | 6.3 | A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails to properly sanitize or encode HTML/JavaScript payloads … | Jun 03, 2026 |
| CVE-2026-36618 | MEDIUM | 4.3 | Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software version (unbound 1.22.0), aiding targeted attacks against … | Jun 03, 2026 |
| CVE-2026-36616 | MEDIUM | 5.9 | Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS test key, and default PSK embedded in … | Jun 03, 2026 |
| CVE-2026-36615 | MEDIUM | 4.3 | Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint that returns internal buffer contents to unauthenticated attackers on the adjacent network. | Jun 03, 2026 |
| CVE-2026-36613 | MEDIUM | 4.3 | Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized internal buffer contents when receiving HTTP POST requests to undefined paths, exposing server … | Jun 03, 2026 |
| CVE-2026-36612 | MEDIUM | 6.4 | Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts). | Jun 03, 2026 |
| CVE-2026-36611 | HIGH | 7.3 | Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing … | Jun 03, 2026 |
| CVE-2026-36610 | MEDIUM | 5.9 | Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding. The firmware contains no TLS implementation, allowing man-in-the-middle … | Jun 03, 2026 |
| CVE-2026-36609 | HIGH | 7.3 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined … | Jun 03, 2026 |
| CVE-2026-36608 | HIGH | 8.8 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own … | Jun 03, 2026 |
| CVE-2026-36607 | HIGH | 8.8 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied … | Jun 03, 2026 |
| CVE-2026-36606 | HIGH | 7.1 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who … | Jun 03, 2026 |
| CVE-2026-36605 | MEDIUM | 6.5 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via a low number of crafted incomplete HTTP requests, … | Jun 03, 2026 |
| CVE-2026-36604 | MEDIUM | 6.5 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks. An external attacker can rebind a … | Jun 03, 2026 |
| CVE-2026-36603 | UNKNOWN | — | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP … | Jun 03, 2026 |
| CVE-2026-36602 | UNKNOWN | — | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP GetStatusInfo action. An unauthenticated attacker on the adjacent network can … | Jun 03, 2026 |
| CVE-2026-36460 | UNKNOWN | — | Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript … | Jun 03, 2026 |
| CVE-2026-20233 | MEDIUM | 6.1 | A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. … | Jun 03, 2026 |
| CVE-2026-20230 | HIGH | 8.6 | A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote … | Jun 03, 2026 |
| CVE-2026-20175 | MEDIUM | 6.1 | A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote locations into an active user session on an … | Jun 03, 2026 |
| CVE-2025-71314 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Recover from panthor_gpu_flush_caches() failures We have seen a few cases where the whole memory … | Jun 03, 2026 |