https://vulnogram.org/ Most recent CVEs assigned by Talos (talos). https://vulnogram.org/seaview/icons/talos.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-35499 https://vulnogram.org/CVE-2026-35499 An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authe… Critical Tue, 20 Oct 2026 20:25:27 GMT https://vulnogram.org/CVE-2026-40627 https://vulnogram.org/CVE-2026-40627 An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an aut… Critical Tue, 20 Oct 2026 20:25:26 GMT https://vulnogram.org/CVE-2026-28763 https://vulnogram.org/CVE-2026-28763 A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker… Critical Tue, 20 Oct 2026 20:25:26 GMT https://vulnogram.org/CVE-2026-41223 https://vulnogram.org/CVE-2026-41223 A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker c… Critical Tue, 20 Oct 2026 20:25:26 GMT https://vulnogram.org/CVE-2026-33568 https://vulnogram.org/CVE-2026-33568 A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make… Critical Tue, 20 Oct 2026 20:25:25 GMT https://vulnogram.org/CVE-2026-41222 https://vulnogram.org/CVE-2026-41222 A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can… Critical Tue, 20 Oct 2026 20:25:25 GMT https://vulnogram.org/CVE-2026-40615 https://vulnogram.org/CVE-2026-40615 A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attac… Critical Tue, 20 Oct 2026 20:25:25 GMT https://vulnogram.org/CVE-2026-42020 https://vulnogram.org/CVE-2026-42020 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker ca… Critical Tue, 20 Oct 2026 20:25:24 GMT https://vulnogram.org/CVE-2026-42019 https://vulnogram.org/CVE-2026-42019 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker ca… Critical Tue, 20 Oct 2026 20:25:24 GMT https://vulnogram.org/CVE-2026-42024 https://vulnogram.org/CVE-2026-42024 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code ex… Critical Tue, 20 Oct 2026 20:25:23 GMT https://vulnogram.org/CVE-2026-42023 https://vulnogram.org/CVE-2026-42023 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code ex… Critical Tue, 20 Oct 2026 20:25:23 GMT https://vulnogram.org/CVE-2026-42022 https://vulnogram.org/CVE-2026-42022 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code ex… Critical Tue, 20 Oct 2026 20:25:23 GMT https://vulnogram.org/CVE-2026-42021 https://vulnogram.org/CVE-2026-42021 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code ex… Critical Tue, 20 Oct 2026 20:25:23 GMT https://vulnogram.org/CVE-2026-42026 https://vulnogram.org/CVE-2026-42026 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execu… Critical Tue, 20 Oct 2026 20:25:23 GMT https://vulnogram.org/CVE-2026-42025 https://vulnogram.org/CVE-2026-42025 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execu… Critical Tue, 20 Oct 2026 20:25:23 GMT https://vulnogram.org/CVE-2026-9660 https://vulnogram.org/CVE-2026-9660 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An att… Critical Tue, 20 Oct 2026 20:25:22 GMT https://vulnogram.org/CVE-2026-9659 https://vulnogram.org/CVE-2026-9659 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An att… Critical Tue, 20 Oct 2026 20:25:22 GMT https://vulnogram.org/CVE-2026-9814 https://vulnogram.org/CVE-2026-9814 An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an… Critical Tue, 20 Oct 2026 20:25:22 GMT https://vulnogram.org/CVE-2026-9817 https://vulnogram.org/CVE-2026-9817 A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make a… Critical Tue, 20 Oct 2026 20:25:21 GMT https://vulnogram.org/CVE-2026-9827 https://vulnogram.org/CVE-2026-9827 A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authe… Critical Tue, 20 Oct 2026 20:25:21 GMT https://vulnogram.org/CVE-2026-9869 https://vulnogram.org/CVE-2026-9869 A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make… Critical Tue, 20 Oct 2026 20:25:21 GMT https://vulnogram.org/CVE-2026-10131 https://vulnogram.org/CVE-2026-10131 An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an a… Critical Tue, 20 Oct 2026 20:25:20 GMT https://vulnogram.org/CVE-2026-10132 https://vulnogram.org/CVE-2026-10132 A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an… Critical Tue, 20 Oct 2026 20:25:20 GMT https://vulnogram.org/CVE-2026-10133 https://vulnogram.org/CVE-2026-10133 A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenti… Critical Tue, 20 Oct 2026 20:25:20 GMT https://vulnogram.org/CVE-2026-10135 https://vulnogram.org/CVE-2026-10135 A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated H… Critical Tue, 20 Oct 2026 20:25:19 GMT https://vulnogram.org/CVE-2026-10136 https://vulnogram.org/CVE-2026-10136 A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an a… Critical Tue, 20 Oct 2026 20:25:19 GMT https://vulnogram.org/CVE-2026-10137 https://vulnogram.org/CVE-2026-10137 A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an… Critical Tue, 20 Oct 2026 20:25:18 GMT https://vulnogram.org/CVE-2026-10138 https://vulnogram.org/CVE-2026-10138 A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authent… Critical Tue, 20 Oct 2026 20:25:18 GMT https://vulnogram.org/CVE-2026-10139 https://vulnogram.org/CVE-2026-10139 A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticate… Critical Tue, 20 Oct 2026 20:25:17 GMT https://vulnogram.org/CVE-2026-10141 https://vulnogram.org/CVE-2026-10141 A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an aut… Critical Tue, 20 Oct 2026 20:25:17 GMT https://vulnogram.org/CVE-2026-41958 https://vulnogram.org/CVE-2026-41958 A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted URL to trig… Medium Network Exploitable Wed, 07 Oct 2026 12:54:54 GMT https://vulnogram.org/CVE-2026-42532 https://vulnogram.org/CVE-2026-42532 A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .eml file can lead to arbitrary file write. An attacker can provide a malicious file to trigger t… Medium Wed, 07 Oct 2026 12:54:53 GMT https://vulnogram.org/CVE-2026-22879 https://vulnogram.org/CVE-2026-22879 A heap-based buffer overflow vulnerability exists in the vtkDICOMItem::FindDataElementOrInsert functionality of vtk-dicom (version(s): 9.5.2). A specially crafted DICOM file can lead to heap-based memory corruption. An attacker can provide a maliciou… High Network Exploitable Thu, 25 Jun 2026 21:46:00 GMT https://vulnogram.org/CVE-2026-25104 https://vulnogram.org/CVE-2026-25104 A heap-based buffer overflow vulnerability exists in the LXF parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulne… High Tue, 26 May 2026 08:41:52 GMT https://vulnogram.org/CVE-2026-25713 https://vulnogram.org/CVE-2026-25713 A heap-based buffer overflow vulnerability exists in the ID3v2 parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted media file that contains ID3v2 tags can lead to arbitrary code execution. An attacker can provide a maliciou… High Tue, 26 May 2026 08:39:55 GMT https://vulnogram.org/CVE-2026-28764 https://vulnogram.org/CVE-2026-28764 A heap-based buffer overflow vulnerability exists in the LXF element parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger th… High Thu, 21 May 2026 08:52:18 GMT https://vulnogram.org/CVE-2026-22554 https://vulnogram.org/CVE-2026-22554 A heap-based buffer overflow vulnerability exists in the Channel Splitting functionality of MediaInfoLib (version(s): 26.01). A specially crafted .riff file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger thi… High Wed, 20 May 2026 13:58:36 GMT https://vulnogram.org/CVE-2025-58074 https://vulnogram.org/CVE-2025-58074 A privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store. A low-privilege user can replace files during the installation process, which may result in deletion of arbitrary files that can lead to… High Unsupported When Assigned Mon, 04 May 2026 13:11:08 GMT https://vulnogram.org/CVE-2026-20911 https://vulnogram.org/CVE-2026-20911 A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to… Critical Network Exploitable Tue, 07 Apr 2026 13:49:31 GMT https://vulnogram.org/CVE-2026-21413 https://vulnogram.org/CVE-2026-21413 A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file… Critical Network Exploitable Tue, 07 Apr 2026 13:49:29 GMT https://vulnogram.org/CVE-2026-20889 https://vulnogram.org/CVE-2026-20889 A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerab… Critical Network Exploitable Tue, 07 Apr 2026 13:49:27 GMT https://vulnogram.org/CVE-2026-24660 https://vulnogram.org/CVE-2026-24660 A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerab… High Network Exploitable Tue, 07 Apr 2026 13:49:25 GMT https://vulnogram.org/CVE-2026-24450 https://vulnogram.org/CVE-2026-24450 An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulne… High Network Exploitable Tue, 07 Apr 2026 13:49:23 GMT https://vulnogram.org/CVE-2026-20884 https://vulnogram.org/CVE-2026-20884 An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability… High Network Exploitable Tue, 07 Apr 2026 13:49:22 GMT https://vulnogram.org/CVE-2025-66342 https://vulnogram.org/CVE-2025-66342 A type confusion vulnerability exists in the EMF functionality of Canva Affinity. A specially crafted EMF file can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. High Tue, 17 Mar 2026 18:52:52 GMT https://vulnogram.org/CVE-2025-62500 https://vulnogram.org/CVE-2025-62500 An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sens… Medium Tue, 17 Mar 2026 18:52:51 GMT https://vulnogram.org/CVE-2025-61979 https://vulnogram.org/CVE-2025-61979 An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sens… Medium Tue, 17 Mar 2026 18:52:49 GMT https://vulnogram.org/CVE-2025-64733 https://vulnogram.org/CVE-2025-64733 An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sens… Medium Tue, 17 Mar 2026 18:52:48 GMT https://vulnogram.org/CVE-2025-66000 https://vulnogram.org/CVE-2025-66000 An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sens… Medium Tue, 17 Mar 2026 18:52:46 GMT https://vulnogram.org/CVE-2025-64301 https://vulnogram.org/CVE-2025-64301 An out‑of‑bounds write vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out‑of‑bounds write, potentially leading to code execution. High Tue, 17 Mar 2026 18:52:44 GMT