CVE-2026-13726

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703 in the setUploadSetting function of /cgi-bin/cstecgi.cgi. Manipulation of the FileName argument leads to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been made public.

A code injection vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2, and when prompt content incorporates request data, attacker-controlled text is compiled and run as an EEx template. This affects ash_ai from 0.1.0 before 1.0.0.

A flaw was found in D-Link DIR-825M 1.1.8 in the sub_41802C function of /boafrm/formLtefotaUpgradeFibocom, related to LTE module firmware upgrade. Manipulation of the fota_url argument causes a stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been published.

A vulnerability was detected in D-Link DIR-825M 1.1.8. It affects the function sub_46725C in the file /boafrm/formDiskFormat of the Disk Formatting Handler Endpoint. Manipulation of the argument partition results in a stack-based buffer overflow. The attack can be executed remotely, and the exploit is public.

A vulnerability in Tenda HG10 300001138 affects the formIPv6Routing function in the file /boaform/admin/formIPv6Routing of the Boa Web Server component. Manipulation of the destNet argument causes a buffer overflow. The attack can be carried out remotely, and the exploit is publicly available.

A vulnerability was identified in TOTOLINK A720R 4.1.5cu.630_B20250509, affecting the setMacFilterRules function in cstecgi.cgi of the MAC Filtering component. Manipulating the desc argument can lead to memory corruption. The attack can be launched remotely, and the exploit has been publicly disclosed.

The MyHome Core plugin for WordPress up to version 4.4.5 contains an authentication bypass vulnerability. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This allows unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators.

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request, persisting it in order meta, and then passing it directly to WP_User::add_role() without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator as the desired role.

Cloud Commander before version 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.