THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,750 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-87866 — When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess…
CVSS unscored / not supplied
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
CVE-2026-87866Read original ↗ (opens in a new tab) - NVD
CVE-2026-87865 — When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to repo…
CVSS unscored / not supplied
When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.
CVE-2026-87865Read original ↗ (opens in a new tab) - NVD
CVE-2026-87864 — Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmittin…
CVSS unscored / not supplied
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.
CVE-2026-87864Read original ↗ (opens in a new tab) - NVD
CVE-2026-87863 — An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails…
CVSS unscored / not supplied
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored d…
CVE-2026-87863Read original ↗ (opens in a new tab) - NVD
CVE-2026-87862 — Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently,…
CVSS unscored / not supplied
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.
CVE-2026-87862Read original ↗ (opens in a new tab) - NVD
CVE-2026-87861 — When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously a…
CVSS unscored / not supplied
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.
CVE-2026-87861Read original ↗ (opens in a new tab) - NVD
CVE-2026-86415 — libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already auth…
CVSS unscored / not supplied
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.
CVE-2026-86415Read original ↗ (opens in a new tab) - NVD
CVE-2026-86414 — An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to th…
CVSS unscored / not supplied
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.
CVE-2026-86414Read original ↗ (opens in a new tab) - NVD
CVE-2026-42026 — Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns2 parameter.
CVE-2026-42026Read original ↗ (opens in a new tab) - NVD
CVE-2026-42025 — Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter.
CVE-2026-42025Read original ↗ (opens in a new tab) - NVD
CVE-2026-42024 — Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionali…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_gw parameter.
CVE-2026-42024Read original ↗ (opens in a new tab) - NVD
CVE-2026-42023 — Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionali…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_ipv6 parameter.
CVE-2026-42023Read original ↗ (opens in a new tab) - NVD
CVE-2026-42022 — Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionali…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns2 parameter.
CVE-2026-42022Read original ↗ (opens in a new tab) - NVD
CVE-2026-42021 — Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionali…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns1 parameter.
CVE-2026-42021Read original ↗ (opens in a new tab) - NVD
CVE-2026-42020 — Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R T…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns2 parameter.
CVE-2026-42020Read original ↗ (opens in a new tab) - NVD
CVE-2026-42019 — Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R T…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns1 parameter.
CVE-2026-42019Read original ↗ (opens in a new tab) - NVD
CVE-2026-41223 — A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): T…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2026-41223Read original ↗ (opens in a new tab) - NVD
CVE-2026-41222 — A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOT…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2026-41222Read original ↗ (opens in a new tab) - NVD
CVE-2026-40627 — An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2026-40627Read original ↗ (opens in a new tab) - NVD
CVE-2026-40615 — A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2026-40615Read original ↗ (opens in a new tab) - NVD
CVE-2026-35499 — An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2026-35499Read original ↗ (opens in a new tab) - NVD
CVE-2026-33568 — A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2026-33568Read original ↗ (opens in a new tab) - NVD
CVE-2026-28763 — A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s):…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2026-28763Read original ↗ (opens in a new tab) - NVD
CVE-2026-112712 — @fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function…
Critical · CVSS 3.1 9.1 · Assessor: ce714d77-add3-4f53-aff5-83d477b104bb
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and for mount paths written without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped midd…
CVE-2026-112712Read original ↗ (opens in a new tab) - NVD
CVE-2026-112407 — Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allo…
High · CVSS 4.0 8.7 · Assessor: ff89ba41-3aa1-4d27-914a-91399e9639e5
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline. To remediate this issue, users should upgrade existing toolchain stacks to version 1.0.11 or later.
CVE-2026-112407Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.