CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the static_ipv6 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.
A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the static_dns2 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.
A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the static_dns1 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.
A stack-based buffer overflow exists in the boa formIpv6Setup pppoe functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the pppoe_dns2 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.
A stack-based buffer overflow exists in the boa formIpv6Setup pppoe functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the pppoe_dns1 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.
A stack-based buffer overflow exists in the boa formMapDelDevice macstr functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.
A stack-based buffer overflow exists in the boa formParentControl url functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.
An OS command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
An OS command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
An OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
@fastify/middie is the Express-style middleware engine for Fastify. In versions 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and mount paths without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped middleware such as authentication, authorization, or rate limiting could be bypassed by a single unauthenticated request. The issue is fixed in @fastify/middie 9.3.6.
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline.
markdown-it versions 14.1.0 to before 14.3.3 and 15.0.0 to before 15.0.3 are O(n²) with default options when parsing a link reference definition whose label or title is never closed, leading to excessive resource consumption.
The PEAK-System PCAN type 0x4030 processing path fails to validate a selected or returned object pointer before dereferencing fixed fields during post-processing.
An unsigned firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerability.
A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
An OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS