Microsoft December 2025 Security Updates

Microsoft December 2025 Early Security Updates

Microsoft November 2025 Security Updates

Microsoft October 2025 Security Updates

Microsoft September 2025 Security Updates

Microsoft August 2025 Security Updates

Microsoft August Early 2025 Security Updates

Microsoft July 2025 Security Updates

Microsoft June 2025 Security Updates

Microsoft June Early 2025 Security Updates

Microsoft May 2025 Security Updates

Microsoft May Early 2025 Security Updates

Microsoft April 2025 Security Updates

Microsoft March 2025 Security Updates

Microsoft March 2025 Early Security Updates

Microsoft February 2025 Security Updates

Microsoft February 2025 Early Security Updates

Microsoft January 2025 Security Updates

Microsoft January 2025 Early Security Updates

Microsoft December 2024 Security Updates

Microsoft November 2024 Security Updates

Microsoft October 2024 Security Updates

Microsoft September 2024 Security Updates

Microsoft August 2024 Security Updates

Microsoft July 2024 Security Updates

Microsoft June 2024 Security Updates

Microsoft May 2024 Security Updates

Microsoft April 2024 Security Updates

Microsoft March 2024 Security Updates

Microsoft February 2024 Security Updates

Microsoft January 2024 Security Updates

titra

Improper Input Validation

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.

kromitgmbh

Titra is an open source project time tracking software. Prior to version 0.99.49, authenticated Admin users can modify the timeEntryRule in the database. The value is then passed to a NodeVM to execute as code. Without proper input sanitization, this leads to Remote Code Execution.

Buffer Overflow via Environment Variables

Server Side Include (SSI) Injection

Cross Zone Scripting

Command Line Execution through SQL Injection

Object Relational Mapping Injection

SQL Injection through SOAP Parameter Tampering

Double Encoding

Subverting Environment Variable Values

Format String Injection

LDAP Injection

Client-side Injection-induced Buffer Overflow

Input Data Manipulation

Flash Injection

XSS Using MIME Type Mismatch

Exploiting Trust in Client

File Content Injection

Serialized Data with Nested Payloads

Oversized Serialized Data Payloads

Filter Failure through Buffer Overflow

XML Injection

Impair Command History Logging

Dynamic Linker Hijacking

Path Interception by PATH Environment Variable

ac20_firmware

Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The impacted element is the function sscanf of the file /goform/PowerSaveSet. The manipulation of the argument powerSavingEn/time/powerSaveDelay/ledCloseType leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AC20

Tenda

A buffer overflow vulnerability exists in Tenda AC20 firmware versions up to and including 16.03.08.12. The vulnerability is located in the /goform/PowerSaveSet endpoint's sscanf function implementation. Improper input validation on the arguments powerSavingEn, time, powerSaveDelay, and ledCloseType allows attackers to trigger a buffer overflow condition, violating memory buffer boundaries.

Overflow Buffers

Buffer Manipulation

MIME Conversion

Overflow Binary Resource File

Buffer Overflow via Symbolic Links

Overflow Variables and Tags

Buffer Overflow via Parameter Expansion

Buffer Overflow in an API Call

Buffer Overflow in Local Command-Line Utilities

String Format Overflow in syslog()

Forced Integer Overflow

dwr-m920_firmware

A vulnerability was identified in D-Link DWR-M920 up to 1.1.50. This issue affects the function sub_464794 of the file /boafrm/formDefRoute. The manipulation of the argument submit-url leads to buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used.

DWR-M920

D-Link

A buffer overflow vulnerability in the D-Link DWR-M920 router (up to version 1.1.50) exists in the function sub_464794 of the /boafrm/formDefRoute file. The vulnerability can be triggered by manipulating the submit-url argument, potentially allowing remote code execution.

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

VPN Firewall developed by QNO Technology has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.

VPN Firewall

QNO Technology

OS Command Injection vulnerability in VPN Firewall developed by QNO Technology. Authenticated remote attackers can inject arbitrary OS commands and execute them on the server.

Command Delimiters

Exploiting Multiple Input Interpretation Layers

Argument Injection

OS Command Injection

An OS Command Injection vulnerability exists in VPN Firewall developed by QNO Technology. The vulnerability allows authenticated remote attackers to inject arbitrary OS commands and execute them on the server due to improper neutralization of special elements used in OS commands.

w6-s_firmware

Stack-based Buffer Overflow

A vulnerability was determined in Tenda W6-S 1.0.0.4(510). This impacts an unknown function of the file /bin/httpd of the component R7websSsecurityHandler. Executing manipulation of the argument Cookie can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

W6-S

A stack-based buffer overflow vulnerability exists in Tenda W6-S firmware version 1.0.0.4(510). The vulnerability is located in the /bin/httpd component, specifically in the R7websSsecurityHandler function. An attacker can manipulate the Cookie argument to trigger a stack-based buffer overflow, which violates proper memory buffer boundary restrictions.

Cypress Solutions CTM-200 2.7.1 contains an authenticated command injection vulnerability in the firmware upgrade script that allows remote attackers to execute shell commands. Attackers can exploit the 'fw_url' parameter in the ctm-config-upgrade.sh script to inject and execute arbitrary commands with root privileges.

Cypress

An authenticated command injection vulnerability exists in Cypress Solutions CTM-200 firmware version 2.7.1. The vulnerability is located in the firmware upgrade script (ctm-config-upgrade.sh) where the 'fw_url' parameter fails to properly sanitize user input, allowing attackers to inject and execute arbitrary shell commands.

mongodb

zlib

Improper Handling of Length Parameter Inconsistency

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

MongoDB Server

MongoDB Inc.

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects MongoDB Server versions: v7.0 prior to 7.0.28, v8.0 prior to 8.0.17, v8.2 prior to 8.2.3, v6.0 prior to 6.0.27, v5.0 prior to 5.0.32, v4.4 prior to 4.4.30, v4.2 (all versions 4.2.0 and later), v4.0 (all versions 4.0.0 and later), and v3.6 (all versions 3.6.0 and later).

jira.mongodb.org

Search CVEs by ID

Trending Vulnerabilities

Latest Patch Tuesday Reports

December 2025 Patch Tuesday: 10 Critical Vulnerabilities Amid 64 CVEs

December 2025 Early Security Update: 0 Critical Vulnerabilities Amid 1 CVEs

November 2025 Patch Tuesday: 8 Critical Vulnerabilities Amid 63 CVEs

Browse

Be the first to know about critical vulnerabilities