THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,238 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUpdates delayed · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-9660 — Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (versio…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter.
CVE-2026-9660Read original ↗ (opens in a new tab) - NVD
CVE-2026-9659 — Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (versio…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnUser parameter.
CVE-2026-9659Read original ↗ (opens in a new tab) - NVD
CVE-2026-94266 — libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials,…
CVSS unscored / not supplied
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.
CVE-2026-94266Read original ↗ (opens in a new tab) - NVD
CVE-2026-94265 — When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously reta…
CVSS unscored / not supplied
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket—generated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absenc…
CVE-2026-94265Read original ↗ (opens in a new tab) - NVD
CVE-2026-92391 — A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cle…
CVSS unscored / not supplied
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.
CVE-2026-92391Read original ↗ (opens in a new tab) - NVD
CVE-2026-92390 — When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an inte…
CVSS unscored / not supplied
When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.
CVE-2026-92390Read original ↗ (opens in a new tab) - NVD
CVE-2026-92389 — libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening…
CVSS unscored / not supplied
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.
CVE-2026-92389Read original ↗ (opens in a new tab) - NVD
CVE-2026-92388 — When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the w…
CVSS unscored / not supplied
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read agains…
CVE-2026-92388Read original ↗ (opens in a new tab) - NVD
CVE-2026-92387 — By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and…
CVSS unscored / not supplied
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.
CVE-2026-92387Read original ↗ (opens in a new tab) - NVD
CVE-2026-92386 — When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that…
CVSS unscored / not supplied
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.
CVE-2026-92386Read original ↗ (opens in a new tab) - NVD
CVE-2026-87866 — When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess…
CVSS unscored / not supplied
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.
CVE-2026-87866Read original ↗ (opens in a new tab) - NVD
CVE-2026-87865 — When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to repo…
CVSS unscored / not supplied
When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.
CVE-2026-87865Read original ↗ (opens in a new tab) - NVD
CVE-2026-87864 — Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmittin…
CVSS unscored / not supplied
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.
CVE-2026-87864Read original ↗ (opens in a new tab) - NVD
CVE-2026-87863 — An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails…
CVSS unscored / not supplied
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored d…
CVE-2026-87863Read original ↗ (opens in a new tab) - NVD
CVE-2026-87862 — Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently,…
CVSS unscored / not supplied
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.
CVE-2026-87862Read original ↗ (opens in a new tab) - NVD
CVE-2026-87861 — When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously a…
CVSS unscored / not supplied
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.
CVE-2026-87861Read original ↗ (opens in a new tab) - NVD
CVE-2026-86415 — libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already auth…
CVSS unscored / not supplied
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.
CVE-2026-86415Read original ↗ (opens in a new tab) - NVD
CVE-2026-86414 — An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to th…
CVSS unscored / not supplied
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.
CVE-2026-86414Read original ↗ (opens in a new tab) - NVD
CVE-2026-42026 — Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns2 parameter.
CVE-2026-42026Read original ↗ (opens in a new tab) - NVD
CVE-2026-42025 — Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter.
CVE-2026-42025Read original ↗ (opens in a new tab) - NVD
CVE-2026-42024 — Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionali…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_gw parameter.
CVE-2026-42024Read original ↗ (opens in a new tab) - NVD
CVE-2026-42023 — Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionali…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_ipv6 parameter.
CVE-2026-42023Read original ↗ (opens in a new tab) - NVD
CVE-2026-42022 — Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionali…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns2 parameter.
CVE-2026-42022Read original ↗ (opens in a new tab) - NVD
CVE-2026-42021 — Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionali…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns1 parameter.
CVE-2026-42021Read original ↗ (opens in a new tab) - NVD
CVE-2026-42020 — Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R T…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns2 parameter.
CVE-2026-42020Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.