CVE Vulnerability Catalog

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. The issue affects the restore.cgi file in the Backup Restore component, where manipulation of the QUERY_STRING argument results in command injection. The attack can be carried out remotely and the exploit is publicly released.

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /www/cgi-bin/upgrade file in the Firmware Upgrade CGI Endpoint component, where manipulation of the QUERY_STRING argument leads to command injection. The attack can be executed remotely and the exploit is publicly available.

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /www/cgi-bin/network_tools file in the CGI Diagnostic Endpoint component, where manipulation of the param/key/val arguments causes command injection. Remote exploitation is possible and the exploit has been publicly disclosed.

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /usr/bin/network_tools file in the LAN IP Configuration Handler component, where manipulation of the ipv4 argument results in command injection. The attack may be launched remotely and the exploit has been made public.

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /usr/bin/network_tools file in the Traceroute Diagnostic Feature component, where manipulation of the url argument leads to command injection. The attack may be initiated remotely and the exploit has been disclosed publicly.

A flaw has been found in OpenClaw up to version 2026.9.5. The affected function is createCanvasHostHandler in extensions/canvas/src/host/server.ts of the Canvas Host Route component. Manipulation can lead to denial of service. The attack can be launched remotely, and the exploit has been published. The suggested fix 'streaming/size-limit' was never shipped - the latest 2026.9.5 still buffers the whole file via readFile(), unlike the sibling WS path which caps at 64KB.

A security vulnerability has been detected in DLR-RM stable-baselines3 up to version 2.9.0. It affects the functions PPO.load, load_replay_buffer, and VecNormalize.load in save_util.py. Such manipulation leads to deserialization. The attack can be launched remotely, and the exploit has been publicly disclosed. In v2.9.0 the PyTorch tensor load path is hardened (weights_only=True), but that hardening was later reverted on master via PR #1913, causing inconsistency across versions. The vulnerability remains in the core stable_baselines3 load APIs.

A vulnerability was detected in dmlc dgl up to version 2.1.0. It impacts the functions load_info and _read_torch_data in utils.py. Performing a manipulation of the path argument results in deserialization. The attack can be initiated remotely, and the exploit is now public. The project was informed of the problem early but has not responded yet.

A weakness has been identified in piskvorky gensim up to version 4.4.0. The impacted element is the Load function in gensim/utils.py of the Model Loader component. Manipulation of the fname argument causes deserialization. The attack can be initiated remotely, and the exploit has been made public. The maintainer closed issue #3663 same-day with no comment, and the unsafe pickle.load in SaveLoad.load remains unguarded.

A security flaw has been discovered in JusticeRage Manalyze 1.0.0 in the function PE::_parse_debug of file manape/pe.cpp (PE Parser component). Manipulation of the misc.Length argument results in an integer underflow. The attack may be performed remotely, and the patch is identified as 3e299685759f4f767088871de58c5d07f98ee382.

A vulnerability was found in D-Link DIR-868L 2.01b05 in the strcpy function of the file /webfa_authentication.cgi in the Authentication Handler component. Manipulating the id/password arguments leads to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been publicly disclosed.

A vulnerability was found in 0717376 cowork_bench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d in the function ControlFlowNode of file local_servers/pdf-tools-mcp/pdf_tools_mcp/server.py (pdf-tools-mcp component). Manipulation of the pdf_file_path argument results in server-side request forgery. The attack can be initiated remotely and the exploit has been made public.

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402 in the functions routerd.wificfg_get/routerd.get_rand_key of the ubus JSON-RPC interface. Manipulation leads to information disclosure, and the attack must be carried out from within the local network. Upgrading to version 1.0.7.260821.161908 addresses the issue.

A flaw has been found in 06ketan slideshot up to 4.4.0 in the function render_slides of file packages/cli/src/renderer.ts. Manipulation of the htmlPath argument causes path traversal. The attack is possible remotely and the exploit has been published.

A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0 in the function Save of file app/Controllers/UserController.php. Manipulation of the role_id argument results in improper privilege management. The attack can be executed remotely and the exploit is now public.

A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32 in the function importTemplate of file src/services/templateService.ts (Template Import Endpoint component). Manipulation leads to improper privilege management. Remote exploitation is possible and the exploit has been disclosed publicly. Upgrading to version 1.0.33 resolves the issue.

A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8 in the function get_file_snippet of file getFileSnippet.ts (MCP Tool component). Manipulation of the projectRootPath/filePath arguments can lead to path traversal. The isPathInsideProjectRoot guard only blocks filePath escaping the attacker-chosen projectRootPath, but the root itself is untrusted client input. The attack may be launched remotely and the exploit is publicly available.

A security flaw has been discovered in newbee-ltd newbee-mall up to version 1.0.0. An unknown function in controller/common/UploadController.java, part of the Goods Save Endpoint component, is impacted. Manipulating the goodsName argument results in cross-site scripting, and the attack can be initiated remotely. The exploit has been publicly released and may be used for attacks.

A vulnerability was identified in 03-lovepreetSingh MCP up to commit f95d035c5317fad81af9828286631053ccb23546. The issue affects the create_file function in app/api/mcp/route.ts. Manipulating the filePath/content arguments leads to path traversal. The attack can be launched remotely, and the exploit is publicly available. The product does not use versioning, so information about affected and unaffected releases is unavailable.

A vulnerability was determined in Free5GC up to 4.2.3 affecting unknown code of file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go (Gmm Handler component). Manipulation causes a race condition. The attack can be initiated remotely and the patch is identified as e323b01464355781b8b8d5dd695e05cbc00a62f2.