---METADATA---
VENDOR: Cisco
PRODUCT: Crosswork Planning
AFFECTED_VERSIONS: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Cisco Crosswork Planning contains a SQL injection vulnerability due to improper neutralization of special elements in SQL commands, which may allow unauthenticated remote code execution.

Executive Summary:
This critical SQL injection vulnerability in Cisco Crosswork Planning allows unauthenticated attackers to execute arbitrary commands, posing a severe risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-20030

Affected Software: Cisco Crosswork Planning

Affected Versions: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.2.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) because it fails to properly sanitize user-supplied input before processing database queries. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that this is an unauthenticated vulnerability requiring no user interaction.

Business Impact

Successful exploitation allows an attacker to manipulate backend database queries, potentially leading to unauthorized data exfiltration, modification, or complete system takeover. Given the CVSS score of 10.0, this vulnerability represents the highest level of risk, capable of causing catastrophic operational disruption and compromise of sensitive network management data.

Remediation Plan

Immediate Action: Update Cisco Crosswork Planning to the latest version provided by the vendor, as specified in the official Cisco security advisory.

Proactive Monitoring: Review application and database logs for anomalous SQL syntax or unexpected query patterns that may indicate automated probing or exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads targeting network management software.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication.

Analyst Recommendation

Due to the critical nature of this vulnerability and the ease of exploitation, organizations must prioritize patching Cisco Crosswork Planning immediately. Administrators should follow the official Cisco security advisory for the specific patch release and ensure all affected instances are updated without delay.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS, IOS XE, ASA, and FTD Software
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in Cisco's IKEv2 implementation allows unauthenticated remote attackers to cause a memory leak. This leak eventually leads to a Denial of Service (DoS) condition on the affected network device.

Executive Summary:
Unauthenticated remote attackers can exploit a memory leak in the IKEv2 feature of multiple Cisco security and networking products to trigger a persistent Denial of Service.

Vulnerability Details

CVE-ID: CVE-2026-20012

Affected Software: Cisco IOS, IOS XE, ASA, and FTD Software

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability exists in the Internet Key Exchange version 2 (IKEv2) feature. An unauthenticated, remote attacker can send crafted IKEv2 packets to an affected device, triggering a memory leak that eventually exhausts system resources.

Business Impact

A successful exploit results in a Denial of Service (DoS), potentially crashing core networking or security infrastructure. This can lead to significant network downtime and loss of connectivity for remote workers and branch offices. The CVSS score of 8.6 indicates a High severity risk to availability.

Remediation Plan

Immediate Action: Apply the software updates provided by Cisco for IOS, IOS XE, ASA, and FTD software to resolve the memory management flaw.

Proactive Monitoring: Monitor device memory utilization and IKEv2 session statistics for unusual growth or exhaustion patterns.

Compensating Controls: If patching is not immediately possible, consider rate-limiting IKEv2 traffic or restricting VPN tunnel establishment to known peer IP addresses where feasible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 26, 2026, there is no public information indicating active exploitation of this vulnerability. Because no authentication is required to trigger the leak, the vulnerability is highly susceptible to remote exploitation.

Analyst Recommendation

Cisco administrators should treat this as a high-priority update. Because this flaw impacts the availability of primary security gateways and routers, immediate patching is the only way to ensure continuous network operations and defense against DoS attacks.

---METADATA---
VENDOR: WowRevenue
PRODUCT: WowRevenue Plugin for WordPress
AFFECTED_VERSIONS: Up to and including 2
---END_METADATA---

Description Summary:
The WowRevenue plugin for WordPress contains a missing capability check in its installation function, allowing unauthorized users to install and activate arbitrary plugins.

Executive Summary:
The WowRevenue WordPress plugin is vulnerable to a critical flaw that allows unauthorized attackers to install malicious plugins and potentially take full control of the website.

Vulnerability Details

CVE-ID: CVE-2026-2001

Affected Software: WowRevenue (WordPress Plugin)

Affected Versions: Up to and including 2

Vulnerability: The vulnerability stems from a missing capability check in the Notice::install_activate_plugin function. This allows an attacker (potentially unauthenticated or low-privileged) to trigger the installation and activation of any plugin from the WordPress repository, which can be leveraged for site takeover.

Business Impact

This vulnerability is high-risk (CVSS 8.8) because it provides a direct path to remote code execution and site compromise. An attacker could install a "file manager" or "web shell" plugin to gain full access to the server, leading to data theft, site defacement, or malware distribution.

Remediation Plan

Immediate Action: Update the WowRevenue plugin to the latest version immediately or deactivate the plugin if a patch is not yet available.

Proactive Monitoring: Review the site's plugin list for any unfamiliar or unauthorized plugins and check the wp-content/plugins directory for suspicious files.

Compensating Controls: Use a security plugin to monitor for unauthorized plugin activations and restrict access to the WordPress administrative AJAX and dashboard functions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 17, 2026, active exploitation has not been reported, but the ability to install arbitrary plugins is a well-known vector for complete site compromise.

Analyst Recommendation

The 8.8 CVSS score indicates an urgent need for remediation. Administrators should not only update the plugin but also perform a thorough security audit of their WordPress installation to ensure no unauthorized changes have been made.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure FMC Software
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The web-based management interface of Cisco Secure FMC Software is vulnerable to an authenticated SQL injection attack, allowing attackers to manipulate or extract sensitive database information.

Executive Summary:
Authenticated attackers can perform SQL injection on Cisco Secure FMC management interfaces, potentially leading to full database compromise and unauthorized administrative control.

Vulnerability Details

CVE-ID: CVE-2026-20002

Affected Software: Cisco Secure FMC Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A flaw in the web-based management interface fails to properly sanitize user-supplied input, allowing an authenticated, remote attacker to execute arbitrary SQL commands. This bypasses standard application logic to interact directly with the underlying database.

Business Impact

This vulnerability carries a CVSS score of 8.1, reflecting a High-severity risk to data confidentiality and integrity. A successful SQL injection can allow an attacker to read sensitive configuration data, modify security policies, or escalate privileges within the Management Center. This could result in a total compromise of the network security management infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-supplied patches for Cisco Secure FMC immediately to address the input validation flaw.

Proactive Monitoring: Enable and review database query logs for suspicious patterns, such as unexpected "UNION" selects or unusual characters in management interface requests.

Compensating Controls: Restrict access to the FMC management interface to a dedicated, isolated management network or VPN, and enforce the principle of least privilege for all administrative accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation. However, SQL injection remains a highly effective and well-understood attack vector for gaining unauthorized access to sensitive systems.

Analyst Recommendation

Because the FMC manages critical security infrastructure, this vulnerability must be addressed with extreme urgency. Apply the necessary patches immediately and ensure that all management traffic is strictly controlled and monitored to prevent unauthorized access to the web interface.

---METADATA---
VENDOR: GL.iNet
PRODUCT: A1300, AX1800, AXT1800, MT2500, MT3000, MT6000
AFFECTED_VERSIONS: 4.8.*
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Multiple GL.iNet router models are susceptible to OS Command Injection due to improper input sanitization in the web management interface.

Executive Summary:
A critical command injection vulnerability in GL.iNet routers allows unauthenticated attackers to execute arbitrary commands with root privileges.

Vulnerability Details

CVE-ID: CVE-2026-19983

Affected Software: GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000

Affected Versions: 4.8.*

Vulnerability: The vulnerability involves an OS command injection flaw where the web management interface fails to sanitize input, allowing an unauthenticated attacker to bypass security checks. This can lead to full device compromise via remote command execution.

Business Impact

This vulnerability carries a severe risk as it allows for complete control over the network infrastructure device. With a CVSS score of 8.3, the potential for unauthorized access to the local network, traffic interception, or the use of the router as a pivot point for further attacks makes this a high-priority security concern.

Remediation Plan

Immediate Action: Update the firmware of all affected GL.iNet devices to version 4.9.0 or later immediately.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the router management interface or unexpected administrative login attempts.

Compensating Controls: Disable remote administrative access to the web interface and isolate management traffic to a secure, internal network segment.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the GL.iNet CVE-issues GitHub repository.

Analyst Notes: As of August 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public proof-of-concept significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

Given the availability of a proof-of-concept and the potential for full system compromise, immediate firmware updates are essential. Network administrators must treat this as a high-urgency task to prevent unauthorized network access and potential exploitation of the router devices.

---METADATA---
VENDOR: GL.iNet
PRODUCT: BE9300, MT6000
AFFECTED_VERSIONS: 4.8.*
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in GL.iNet firmware allows authenticated attackers to execute arbitrary system commands via the firewall configuration interface.

Executive Summary:
A high-severity OS command injection vulnerability in GL.iNet firmware allows authenticated attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-19982

Affected Software: GL.iNet BE9300 and MT6000

Affected Versions: 4.8.*

Vulnerability: This vulnerability involves an OS command injection flaw (CWE-78) triggered by improper input validation within the firewall management functions. Successful exploitation requires the attacker to have low-level authenticated access to the device management interface.

Business Impact

The ability for an attacker to execute arbitrary commands on network infrastructure poses a significant risk to organizational security. This vulnerability could lead to full device compromise, lateral movement into internal segments, or the redirection of network traffic. Given the CVSS score of 7.4, this issue is classified as High severity and requires prompt remediation to prevent unauthorized system control.

Remediation Plan

Immediate Action: Update all affected GL.iNet devices to firmware version 4.9.0 or later to apply the necessary security patches.

Proactive Monitoring: Review device access logs for unusual administrative activity or unexpected system calls originating from the firewall configuration module.

Compensating Controls: Restrict access to the device management interface to trusted administrative IP addresses only, and employ a Web Application Firewall or similar network security appliance to inspect traffic for command injection patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any authenticated user with access to the management console.

Analyst Recommendation

The risk posed by this OS command injection vulnerability is substantial, as it allows for complete control over the network appliance. Administrators should prioritize upgrading firmware to version 4.9.0 across all deployed BE9300 and MT6000 units immediately to neutralize this threat.

---METADATA---
VENDOR: GL.iNet
PRODUCT: A1300, AX1800, AXT1800, BE1400, BE3600, BE6500
AFFECTED_VERSIONS: 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in GL.iNet firmware allows authenticated attackers to execute arbitrary code via the Wi-Fi timer or power schedule cron jobs.

Executive Summary:
An OS command injection vulnerability in multiple GL.iNet router models allows authenticated attackers to execute arbitrary code via scheduling features.

Vulnerability Details

CVE-ID: CVE-2026-19981

Affected Software: GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, and BE6500

Affected Versions: 4.0 through 4.7

Vulnerability: This vulnerability is an OS command injection flaw (CWE-78) occurring within the cron job handling logic for power and Wi-Fi scheduling. An attacker with low-level authenticated access can manipulate these parameters to execute system-level commands.

Business Impact

Successful exploitation grants an attacker the ability to execute commands with the privileges of the system, potentially resulting in complete device takeover. Because these devices serve as critical network gateways, such a compromise could facilitate man-in-the-middle attacks or internal network reconnaissance. The CVSS score of 7.4 underscores the high risk of this vulnerability to organizational network integrity.

Remediation Plan

Immediate Action: Check the vendor website for the latest firmware updates and apply them as soon as they become available for the specific router model.

Proactive Monitoring: Monitor system logs for unexpected execution of cron tasks or modifications to scheduled power settings.

Compensating Controls: Limit access to the device web interface to authorized personnel and ensure that administrative credentials are complex and unique.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of this flaw makes it highly susceptible to exploitation if an attacker gains authenticated access.

Analyst Recommendation

Given the breadth of affected hardware, administrators must perform an inventory of all GL.iNet devices and prepare for firmware deployment. Until patches are applied, restrict management interface access to minimize the window of opportunity for an attacker to authenticate.

---METADATA---
VENDOR: GL.iNet
PRODUCT: A1300, AX1800, AXT1800, BE1400, BE3600, BE6500
AFFECTED_VERSIONS: 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A code injection vulnerability in GL.iNet firmware allows authenticated attackers to execute arbitrary code via the language auto-update cron functionality.

Executive Summary:
A high-severity code injection vulnerability in various GL.iNet routers allows authenticated attackers to gain unauthorized code execution via the auto-update mechanism.

Vulnerability Details

CVE-ID: CVE-2026-19980

Affected Software: GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, and BE6500

Affected Versions: 4.0 through 4.7

Vulnerability: This vulnerability is a code injection flaw (CWE-94) found within the language auto-update cron process. An attacker with authenticated access can inject malicious commands into the update process, which are then executed by the system.

Business Impact

Exploitation of this vulnerability allows an attacker to execute arbitrary code, which can be leveraged to maintain persistence on the device or exfiltrate sensitive configuration data. The CVSS score of 7.4 reflects the high severity of this issue, as it directly impacts the confidentiality, integrity, and availability of the affected network infrastructure.

Remediation Plan

Immediate Action: Monitor official GL.iNet security advisories and apply firmware updates as soon as they are released for your specific model.

Proactive Monitoring: Review system logs for unusual cron job activity or unexpected processes initiated by the language update service.

Compensating Controls: Disable unnecessary management services and ensure that the administrative interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly concerning due to its presence in an automated background service.

Analyst Recommendation

Administrators should treat this vulnerability with high urgency. Because it affects multiple models within the GL.iNet ecosystem, a coordinated update strategy is recommended. Ensure that all devices are running the latest firmware to mitigate risks associated with code injection.

---METADATA---
VENDOR: GL.iNet
PRODUCT: A1300, AX1800, AXT1800, BE1400, BE3600, BE6500
AFFECTED_VERSIONS: 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Multiple GL.iNet router models are susceptible to an authorization bypass vulnerability in the WebDAV public-share feature, allowing unauthenticated access to shared resources.

Executive Summary:
An authorization bypass vulnerability in GL.iNet routers allows unauthenticated attackers to access restricted WebDAV public shares, posing a significant risk of unauthorized data exposure.

Vulnerability Details

CVE-ID: CVE-2026-19979

Affected Software: GL.iNet various router models (A1300, AX1800, AXT1800, BE1400, BE3600, BE6500)

Affected Versions: 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7

Vulnerability: The vulnerability involves an improper authorization mechanism within the WebDAV public-share function (CWE-639, CWE-285). This flaw permits unauthenticated network-adjacent or remote attackers to bypass access controls and interact with shared data.

Business Impact

The ability for an unauthenticated user to bypass authorization controls on a network device represents a significant breach of confidentiality and integrity. Given the CVSS score of 8.3, this high-severity vulnerability could lead to the unauthorized retrieval of sensitive files stored on connected storage media or the injection of malicious content into shared directories. Such exposure may result in data loss, regulatory non-compliance, and potential compromise of internal network information.

Remediation Plan

Immediate Action: Disable the WebDAV public-share feature on all affected GL.iNet devices until a security patch is released by the vendor.

Proactive Monitoring: Review system and WebDAV access logs for unauthorized file access attempts or anomalous traffic patterns originating from unknown IP addresses.

Compensating Controls: Implement network-level access control lists or a firewall to restrict access to the WebDAV service to known, trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is high due to the lack of required authentication for the vulnerable function.

Analyst Recommendation

Given the severity of this authorization bypass, administrators must prioritize the immediate disabling of the vulnerable WebDAV feature. Users should monitor official GL.iNet firmware update channels closely and apply the forthcoming patch as soon as it is made available to fully remediate the underlying logic error.

---METADATA---
VENDOR: EFM
PRODUCT: ipTIME A3004T
AFFECTED_VERSIONS: 14.19.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A session validation vulnerability in EFM ipTIME A3004T 14.19.0 allows unauthenticated remote attackers to bypass authentication mechanisms via the httpcon_check_session_url function.

Executive Summary:
A critical improper authentication vulnerability in EFM ipTIME A3004T 14.19.0 allows unauthenticated remote attackers to bypass security controls.

Vulnerability Details

CVE-ID: CVE-2026-19977

Affected Software: EFM ipTIME A3004T

Affected Versions: 14.19.0

Vulnerability: The flaw exists in the httpcon_check_session_url function within the session validation component. It allows an unauthenticated attacker to manipulate session checks, effectively bypassing the authentication process entirely.

Business Impact

This vulnerability carries a CVSS score of 10.0, representing the highest possible severity. An attacker can gain unauthorized, full administrative access to the device, facilitating complete system takeover. This could lead to total compromise of network traffic, credential theft, or the use of the device as a persistent beachhead within the internal network.

Remediation Plan

Immediate Action: Monitor the EFM website for emergency firmware patches, as no official fix is currently available from the vendor.

Proactive Monitoring: Implement strict logging for all administrative login attempts and session creation events on the device.

Compensating Controls: Isolate the device from external networks using a hardware firewall, ensuring that the web management interface is inaccessible to untrusted sources.

Exploitation Status

Public Exploit Available: No (No confirmed weaponized exploit is documented in the provided data.)

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a published proof-of-concept. However, given the critical authentication bypass nature of the flaw, the risk of exploitation is high.

Analyst Recommendation

The severity of this authentication bypass necessitates immediate isolation of affected devices. Administrators should prioritize disabling remote management features or restricting access to the web interface via network ACLs until the vendor provides a secure firmware update.

---METADATA---
VENDOR: Edimax
PRODUCT: EW-7478APC
AFFECTED_VERSIONS: 1.04
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability exists in the Edimax EW-7478APC router, potentially allowing an authenticated attacker to execute arbitrary system commands.

Executive Summary:
A high-severity command injection vulnerability in the Edimax EW-7478APC router poses a significant risk of unauthorized system command execution by authenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-19963

Affected Software: Edimax EW-7478APC

Affected Versions: 1.04

Vulnerability: This vulnerability is a command injection flaw, categorized under CWE-77 and CWE-74, which allows an attacker with low-level privileges to inject and execute arbitrary system commands through the affected software interface.

Business Impact

The ability for an attacker to perform command injection on network infrastructure equipment like the Edimax EW-7478APC can lead to full device compromise, unauthorized network access, and the potential for lateral movement within the environment. With a CVSS score of 7.4, this vulnerability represents a high risk to business operations, as it may result in data exfiltration or the persistent disruption of critical network services.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict management access to the device to trusted IP addresses only and monitor vendor channels for firmware updates.

Proactive Monitoring: Review system logs for suspicious process execution patterns or unexpected shell-like commands originating from the web management interface.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent network inspection tool to detect and block common command injection syntax in HTTP requests targeting the device.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability's inherent nature as a command injection flaw makes it highly dangerous if an attacker gains initial access to the management interface.

Analyst Recommendation

Given the high severity and the confirmed existence of a proof-of-concept, users of the Edimax EW-7478APC should treat this vulnerability with urgency. Prioritize isolating the management interface from untrusted networks and verify if the vendor has released a firmware update to resolve the underlying command injection flaw.

---METADATA---
VENDOR: Edimax
PRODUCT: EW-7478APC
AFFECTED_VERSIONS: 1.04
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Edimax EW-7478APC router allows remote attackers to execute arbitrary code via a crafted SSID parameter.

Executive Summary:
A critical buffer overflow vulnerability in the Edimax EW-7478APC router enables remote code execution, posing an immediate risk to device integrity.

Vulnerability Details

CVE-ID: CVE-2026-19961

Affected Software: Edimax EW-7478APC

Affected Versions: 1.04

Vulnerability: The vulnerability resides in the formWlSiteSurvey function within the /goform/formWlSiteSurvey file. By manipulating the selSSID argument, an attacker can trigger a buffer overflow, potentially leading to remote code execution.

Business Impact

Exploitation of this vulnerability grants an attacker complete control over the affected network device. Given the CVSS score of 9.9, this creates a critical risk of network interception, unauthorized access to internal resources, and the potential for the device to be used as a pivot point for further lateral movement within the network.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Edimax. If no update is available, restrict management access to the device to trusted internal networks only.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or signs of device instability that may suggest exploitation.

Compensating Controls: Disable wireless site survey features if not required, and place the management interface on a separate, isolated VLAN to prevent remote access.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 16, 2026, there is no public information indicating active exploitation or a confirmed weaponized public exploit. However, the report indicates that a proof-of-concept exists and the vendor has not responded to disclosure, increasing the risk of unpatched exploitation.

Analyst Recommendation

This is a critical vulnerability that allows for full remote compromise of the router. Administrators should verify the firmware version and apply updates immediately. If patching is not possible, segment the device from the internet to prevent remote exploitation.

---METADATA---
VENDOR: Edimax
PRODUCT: EW-7478APC
AFFECTED_VERSIONS: 1.04
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Edimax EW-7478APC formWanTcpipSetup function allows remote attackers to execute arbitrary code via the pppUserName argument.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Edimax EW-7478APC 1.04 allows remote attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-19959

Affected Software: Edimax EW-7478APC

Affected Versions: 1.04

Vulnerability: This is a stack-based buffer overflow occurring within the formWanTcpipSetup function, triggered by improper handling of the pppUserName argument. The vulnerability requires low privileges (authenticated) to trigger, as indicated by the CVSS vector.

Business Impact

Successful exploitation allows a remote attacker to execute arbitrary code with the privileges of the application, potentially leading to a full system compromise. Given the critical CVSS score of 9.9, this vulnerability poses a severe risk to network integrity and data confidentiality. Failure to remediate could result in unauthorized administrative control over the affected hardware.

Remediation Plan

Immediate Action: Contact Edimax support or monitor official channels for firmware updates, as the vendor has not provided a patch to date.

Proactive Monitoring: Review device access logs for unusual traffic patterns or malformed requests targeting the web management interface.

Compensating Controls: Restrict access to the device management interface to trusted management subnets or utilize a firewall to block unauthorized access to the affected web component.

Exploitation Status

Public Exploit Available: No (The provided data indicates no confirmed public weaponized exploit, despite the description mentioning public availability.)

Analyst Notes: As of August 16, 2026, there is no public information confirming a weaponized exploit, though the vulnerability is inherently dangerous due to its nature as a memory corruption flaw. The lack of vendor responsiveness increases the risk profile significantly.

Analyst Recommendation

Due to the critical nature of this buffer overflow and the lack of a vendor-supplied patch, immediate network segmentation is required. Ensure the management interface of the Edimax EW-7478APC is not exposed to the public internet and limit access to verified administrative personnel until a firmware update is released.

---METADATA---
VENDOR: IDrive
PRODUCT: id_service
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in IDrive’s id_service component. The flaw could allow for unauthorized actions or service disruption depending on the specific implementation of the service.

Executive Summary:
IDrive’s id_service is affected by a high-severity vulnerability that could compromise the integrity and availability of backup services if left unaddressed.

Vulnerability Details

CVE-ID: CVE-2026-1995

Affected Software: IDrive id_service

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability affects the "id_service" component of the IDrive backup solution. While specific technical details are limited in the current summary, the high CVSS score suggests a significant flaw in how the service handles requests or manages permissions.

Business Impact

Exploitation of this service could lead to the disruption of critical backup operations or unauthorized access to sensitive data stored within the IDrive ecosystem. The CVSS score of 7.8 justifies a High severity rating, indicating a substantial risk to data availability and organizational business continuity.

Remediation Plan

Immediate Action: Apply the latest security updates provided by IDrive for the id_service component immediately.

Proactive Monitoring: Review service logs for the id_service for any unexpected crashes, restarts, or unauthorized connection attempts.

Compensating Controls: Restrict network access to the id_service to known, trusted IP addresses using host-based firewalls or network segmentation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, backup services are high-value targets for ransomware actors, making prompt patching essential.

Analyst Recommendation

Organizations relying on IDrive for data redundancy should prioritize the application of this patch. Ensuring the security of backup services is critical to defending against data loss and maintaining operational resilience in the event of a broader cyberattack.

---METADATA---
VENDOR: s2Member
PRODUCT: s2Member Plugin for WordPress
AFFECTED_VERSIONS: All versions up to, and including, 260127
---END_METADATA---

Description Summary:
The s2Member plugin for WordPress allows unauthenticated privilege escalation via account takeover due to insufficient identity validation during password updates in versions up to 260127.

Executive Summary:
An unauthenticated attacker can gain full administrative control over WordPress sites by exploiting a critical password validation flaw in the s2Member plugin.

Vulnerability Details

CVE-ID: CVE-2026-1994

Affected Software: s2Member Plugin for WordPress

Affected Versions: All versions up to, and including, 260127

Vulnerability: This vulnerability is a critical privilege escalation flaw where the plugin fails to verify a user's identity before processing a password change request. This allows an unauthenticated remote attacker to reset any user's password, including administrative accounts, by targeting the vulnerable password update function.

Business Impact

A successful exploit results in a total loss of confidentiality, integrity, and availability. By taking over administrative accounts, attackers can steal sensitive user data, deface the website, or install malicious backdoors. The CVSS score of 9.8 reflects the critical nature of this flaw, as it requires no prior authentication or user interaction to compromise the entire web environment.

Remediation Plan

Immediate Action: Immediately update the s2Member plugin to the latest patched version (greater than 260127) to close the authentication bypass vector.

Proactive Monitoring: Review WordPress user logs for unauthorized password changes and audit all administrative accounts for unrecognized email addresses or suspicious activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block unauthorized requests to plugin-specific password reset endpoints until the update is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its potential for automated mass-exploitation, the risk to WordPress site owners is extremely high.

Analyst Recommendation

The ability for an unauthenticated actor to seize administrative control represents the highest possible risk tier. Organizations utilizing the s2Member plugin must prioritize this update above all other routine maintenance. Failure to patch immediately leaves the site vulnerable to complete takeover and permanent data loss.

---METADATA---
VENDOR: Evergreen
PRODUCT: Evergreen
AFFECTED_VERSIONS: 3.14.0, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.5, 3.14.6, 3.14.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Evergreen contains a SQL injection vulnerability that may allow unauthenticated attackers to execute unauthorized database queries.

Executive Summary:
A high-severity SQL injection vulnerability in Evergreen allows unauthenticated attackers to potentially compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2026-19926

Affected Software: Evergreen

Affected Versions: 3.14.0, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.5, 3.14.6, 3.14.7

Vulnerability: This is a SQL injection vulnerability (CWE-89) that permits an unauthenticated attacker to manipulate database queries. The vulnerability stems from improper neutralization of special elements used in an SQL command.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high risk of unauthorized data access or modification. Successful exploitation could lead to the exposure of sensitive institutional data, corruption of records, or significant service disruption, potentially violating data privacy regulations.

Remediation Plan

Immediate Action: Update to Evergreen versions 3.14.12, 3.15.12, 3.16.6, or 3.17-beta2 immediately to incorporate the necessary security patches.

Proactive Monitoring: Review database query logs for unusual syntax or patterns that deviate from standard application behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for unauthenticated remote exploitation.

Analyst Recommendation

Given the high CVSS score and the nature of SQL injection, organizations running the affected versions of Evergreen must prioritize patching. Failure to remediate this vulnerability leaves the backend database exposed to unauthorized commands, posing a critical risk to the confidentiality and integrity of the system.

---METADATA---
VENDOR: Tenda
PRODUCT: AC10
AFFECTED_VERSIONS: 16.03.10.09_multi_TDE01
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Tenda AC10 router is vulnerable to an authentication bypass in the R7WebsSecurityHandler function, allowing unauthenticated remote attackers to gain unauthorized access.

Executive Summary:
An authentication bypass vulnerability in the Tenda AC10 router allows unauthenticated remote attackers to gain administrative access to the device.

Vulnerability Details

CVE-ID: CVE-2026-19924

Affected Software: Tenda AC10

Affected Versions: 16.03.10.09_multi_TDE01

Vulnerability: The httpd component contains an improper authentication flaw in the R7WebsSecurityHandler function. This flaw can be triggered remotely by an unauthenticated attacker to bypass security controls.

Business Impact

An attacker gaining administrative access to a router can intercept network traffic, modify DNS settings to redirect users to malicious sites, or use the device as a pivot point for further attacks on the internal network. The CVSS score of 9.8 reflects the high potential for unauthorized access and network-wide compromise.

Remediation Plan

Immediate Action: Check the Tenda support website for firmware updates addressing this authentication issue.

Proactive Monitoring: Monitor router logs for unauthorized login attempts or unexpected configuration changes.

Compensating Controls: Disable remote management interfaces on the WAN side to prevent external access to the device's web management console.

Exploitation Status

Public Exploit Available: Yes — a public exploit has been disclosed via a GitHub repository.

Analyst Notes: As of Aug 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the publicly available proof-of-concept code.

Analyst Recommendation

The existence of a public exploit significantly increases the risk to Tenda AC10 devices. Administrators should ensure that remote management is disabled immediately and apply the latest firmware update as soon as it becomes available from the manufacturer. Failure to secure the device may result in full network compromise.

---METADATA---
VENDOR: code-projects
PRODUCT: Online Shopping System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Online Shopping System by code-projects is vulnerable to SQL injection, which may allow unauthenticated attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in the code-projects Online Shopping System exposes the underlying database to unauthorized manipulation and data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-19919

Affected Software: code-projects Online Shopping System

Affected Versions: 1.0

Vulnerability: This vulnerability involves CWE-89 (SQL Injection) and CWE-74 (Injection), allowing unauthenticated attackers to interact with the database through malicious input.

Business Impact

The ability to perform SQL injection allows an attacker to bypass authentication, access sensitive customer or transaction data, and potentially modify or delete records. With a CVSS score of 7.3, this vulnerability represents a high risk to business operations, data privacy, and overall platform security.

Remediation Plan

Immediate Action: Review the application for available security patches from the vendor and implement parameterized queries to sanitize all user-supplied input.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected SQL keywords or syntax errors that suggest injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection attack signatures.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a confirmed weaponized public exploit for this vulnerability. While a proof-of-concept has been identified in external research, it should not be confused with active exploitation in the wild.

Analyst Recommendation

Due to the ease of exploitation for SQL injection flaws, organizations using this software must treat this as a high-priority issue. If a patch is not currently available, immediate implementation of robust input validation and WAF protection is required to mitigate the risk of data compromise.

---METADATA---
VENDOR: PAX Technology
PRODUCT: Q80
AFFECTED_VERSIONS: 2.6.33.6690R
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A signature verification bypass vulnerability exists in the PAX Technology Q80 application installer, which could allow an attacker to execute arbitrary code.

Executive Summary:
A critical remote code execution vulnerability in the PAX Technology Q80 application installer poses a significant risk to device integrity and security.

Vulnerability Details

CVE-ID: CVE-2026-19910

Affected Software: PAX Technology Q80

Affected Versions: 2.6.33.6690R

Vulnerability: This vulnerability, identified as CWE-347, stems from the improper verification of cryptographic signatures during the application installation process. The attack vector is adjacent, and successful exploitation does not require user interaction or authentication.

Business Impact

Successful exploitation of this flaw allows an attacker to bypass security controls and execute arbitrary code on the affected PAX Q80 device. Given the CVSS score of 7.5, this high severity vulnerability could result in full system compromise, unauthorized data access, and the potential for persistent malware installation on payment terminals.

Remediation Plan

Immediate Action: Organizations should restrict network access to affected terminals and monitor vendor channels for the release of an official security patch.

Proactive Monitoring: Security teams should monitor device logs for unusual installation activity or unauthorized process executions originating from the application installer.

Compensating Controls: Implement strict network segmentation to ensure that only authorized management systems can communicate with the Q80 devices, effectively limiting the adjacent attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the attack, requiring adjacent network access, provides a degree of natural mitigation.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate attention to network security and access control. Administrators must prioritize the installation of vendor-provided patches as soon as they become available to eliminate the underlying signature verification flaw.

---METADATA---
VENDOR: PAX
PRODUCT: Q80
AFFECTED_VERSIONS: PAX Technology Q80: 2.6.33.6690R
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The PAX Technology Q80 terminal contains an improper link resolution vulnerability during AIP file parsing that may allow an unauthenticated attacker to achieve remote code execution.

Executive Summary:
An improper link resolution vulnerability in the PAX Technology Q80 terminal could enable remote code execution if an attacker can influence the AIP file parsing process.

Vulnerability Details

CVE-ID: CVE-2026-19909

Affected Software: PAX Technology Q80

Affected Versions: PAX Technology Q80: 2.6.33.6690R

Vulnerability: This vulnerability, categorized as CWE-59, stems from improper link resolution before file access during the parsing of AIP files. An attacker can leverage this flaw to perform unauthorized file operations, potentially leading to remote code execution.

Business Impact

A successful exploit could result in full device compromise, allowing an attacker to intercept payment data or manipulate terminal functionality. Given the CVSS score of 7.5, this vulnerability represents a significant threat to the integrity and confidentiality of transaction processing systems.

Remediation Plan

Immediate Action: Contact PAX Technology or your payment terminal provider to obtain the necessary firmware update for the Q80 device.

Proactive Monitoring: Monitor network traffic for anomalous data patterns directed at payment terminals and investigate any unexpected terminal reboots or errors.

Compensating Controls: Isolate payment terminals on a separate, restricted network segment to minimize exposure to potentially malicious traffic.

Exploitation Status

Public Exploit Available: unknown

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires adjacency, which limits the potential attack vector to the local network environment.

Analyst Recommendation

Due to the nature of the device as a payment terminal, this vulnerability poses a critical risk to financial security. Security teams should prioritize vendor coordination to obtain and deploy the required firmware patch as soon as it becomes available.

---METADATA---
VENDOR: PAX Technology
PRODUCT: Q80
AFFECTED_VERSIONS: 2.6.33.6690R
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The PAX Technology Q80 XCB Daemon contains a missing authentication vulnerability, allowing unauthenticated adjacent attackers to access critical functions.

Executive Summary:
A missing authentication flaw in the PAX Technology Q80 XCB Daemon exposes critical system functions to unauthorized access by adjacent attackers.

Vulnerability Details

CVE-ID: CVE-2026-19908

Affected Software: PAX Technology Q80

Affected Versions: 2.6.33.6690R

Vulnerability: This vulnerability is categorized as a missing authentication for a critical function (CWE-306). It allows an unauthenticated attacker on an adjacent network to interact with the XCB daemon, which lacks the necessary authorization checks to prevent unauthorized command execution or data access.

Business Impact

The lack of authentication on a critical daemon poses a significant risk to the integrity and confidentiality of the affected payment terminal. With a CVSS score of 7.1, this high-severity vulnerability could allow an attacker to gain unauthorized control over device functions, potentially leading to the compromise of sensitive transaction data or disruption of payment processing services.

Remediation Plan

Immediate Action: Update the PAX Technology Q80 firmware to the version provided by the vendor that addresses this missing authentication flaw.

Proactive Monitoring: Monitor network traffic for unusual activity originating from adjacent devices, specifically targeting the XCB daemon ports.

Compensating Controls: Implement network segmentation to isolate payment terminals from untrusted adjacent devices, effectively restricting the attack surface.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for adjacent network access somewhat limits the scope of potential exploitation.

Analyst Recommendation

Given the high CVSS score and the nature of the affected device as a payment terminal, organizations must prioritize patching this vulnerability. Ensure that all Q80 units are running the latest firmware to eliminate the authentication bypass risk and prevent potential unauthorized access.

---METADATA---
VENDOR: Jinher
PRODUCT: OA
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Jinher OA version 1.0 contains a vulnerability involving SQL injection and improper neutralization of special elements, allowing unauthenticated attackers to query the database.

Executive Summary:
An unauthenticated SQL injection vulnerability in Jinher OA allows attackers to interact with the backend database, posing a significant risk to organizational data.

Vulnerability Details

CVE-ID: CVE-2026-19905

Affected Software: Jinher OA

Affected Versions: 1.0

Vulnerability: This issue is characterized by CWE-89 (SQL Injection) and CWE-74 (Injection), which permit an unauthenticated attacker to manipulate backend database queries through unsanitized input.

Business Impact

Exploiting this vulnerability can lead to unauthorized access to sensitive corporate information stored within the OA system. Given the CVSS score of 7.3, this is a high-severity risk that could result in significant data breaches and a loss of trust in the platform's security controls.

Remediation Plan

Immediate Action: Contact the vendor for official patches or security updates and ensure all database-interacting code uses prepared statements.

Proactive Monitoring: Analyze application and database logs for anomalous query structures or unauthorized attempts to access system tables.

Compensating Controls: Use a Web Application Firewall (WAF) to filter out malicious SQL payloads before they reach the application layer.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a confirmed weaponized public exploit for this vulnerability. While external research has highlighted the issue, it does not currently demonstrate broad exploitation in the wild.

Analyst Recommendation

SQL injection is a well-understood but critical threat that requires immediate remediation. Security teams should prioritize limiting the exposure of the OA system and ensuring that input sanitization is rigorously enforced across all modules to mitigate this high-risk vulnerability.

---METADATA---
VENDOR: LB-LINK
PRODUCT: X-PRO
AFFECTED_VERSIONS: LB-LINK X-PRO: 1.0.22-20231206
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
LB-LINK X-PRO 1.0.22-20231206 contains hard-coded credentials, allowing unauthenticated remote access to management interfaces.

Executive Summary:
The presence of hard-coded credentials in the LB-LINK X-PRO device poses a critical risk of unauthorized remote administration and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-19901

Affected Software: LB-LINK X-PRO

Affected Versions: LB-LINK X-PRO: 1.0.22-20231206

Vulnerability: This vulnerability involves the use of hard-coded credentials (CWE-798, CWE-259) for remote management functions, which allows an unauthenticated attacker to gain full administrative access to the device.

Business Impact

Successful exploitation allows an attacker to bypass authentication mechanisms entirely, leading to unauthorized control over the device. Given the CVSS score of 8.1, this is a high-severity issue that could result in complete loss of confidentiality and integrity for the affected network segment, potentially facilitating further lateral movement within the infrastructure.

Remediation Plan

Immediate Action: Since no official patch is currently identified, isolate the device from the public internet immediately and disable remote management features.

Proactive Monitoring: Review network access logs for unusual traffic targeting management ports and monitor for unauthorized login attempts or configuration changes.

Compensating Controls: Deploy a Web Application Firewall or network access control list to restrict management interface access to trusted, internal IP addresses only.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the static nature of the embedded credentials, which cannot be rotated by the end user.

Analyst Recommendation

This vulnerability represents a significant security oversight that exposes the device to complete compromise. Organizations must prioritize restricting network access to the affected hardware immediately and monitor for vendor-released firmware updates to address the underlying hard-coded credential issue.

---METADATA---
VENDOR: LB-LINK
PRODUCT: X-PRO
AFFECTED_VERSIONS: LB-LINK X-PRO: 1.0.22-20231206
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
LB-LINK X-PRO 1.0.22-20231206 contains hard-coded credentials, allowing unauthenticated remote access to management interfaces.

Executive Summary:
The discovery of hard-coded credentials in the LB-LINK X-PRO device creates a critical risk of unauthorized administrative access and potential system takeover.

Vulnerability Details

CVE-ID: CVE-2026-19900

Affected Software: LB-LINK X-PRO

Affected Versions: LB-LINK X-PRO: 1.0.22-20231206

Vulnerability: This vulnerability consists of hard-coded credentials (CWE-798, CWE-259) embedded within the firmware, which grants an unauthenticated attacker the ability to interact with the device management systems without valid credentials.

Business Impact

The CVSS score of 8.1 highlights the high severity of this flaw, as it allows attackers to gain administrative control of networking hardware. This could lead to severe operational disruption, data interception, or the use of the device as a pivot point for further malicious activity within the local network.

Remediation Plan

Immediate Action: Isolate affected devices from the internet and disable all remote management interfaces until a vendor-provided firmware update is applied.

Proactive Monitoring: Monitor management interfaces for unauthorized access attempts and perform regular audits of configuration settings to identify unexpected changes.

Compensating Controls: Utilize network-level segmentation or firewall rules to prevent unauthorized hosts from reaching the device management ports.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable once the hard-coded credentials are discovered by an adversary.

Analyst Recommendation

Given the high severity of this vulnerability, administrators must act quickly to remove public exposure of the device management interfaces. Contact the vendor for firmware guidance and implement strict network access controls to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Class and Exam Timetabling System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System version 1.0, which allows unauthenticated attackers to execute arbitrary database queries.

Executive Summary:
A critical SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0 allows unauthenticated attackers to potentially compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-19899

Affected Software: SourceCodester Class and Exam Timetabling System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) because it fails to properly sanitize user-supplied input. This flaw is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector AV:N/PR:N.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive institutional data, modification of exam schedules, or complete database compromise. Given the CVSS score of 7.3, this represents a significant risk to the integrity and availability of the timetabling system and the information stored within it.

Remediation Plan

Immediate Action: Contact the vendor for available security patches or updates to address this injection flaw.

Proactive Monitoring: Inspect web server logs for suspicious URL patterns containing SQL syntax or unusual query strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SQL injection flaws are high-value targets for attackers seeking to exfiltrate data from backend systems.

Analyst Recommendation

Organizations utilizing this software must treat this as a high-priority risk. Until a vendor-supplied patch is identified and applied, ensure that strict input validation is enforced and that the database user permissions follow the principle of least privilege to limit the impact of a potential breach.

---METADATA---
VENDOR: Eclipse Foundation
PRODUCT: Eclipse Theia
AFFECTED_VERSIONS: 0 up to (excluding) 1.70.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Eclipse Theia contains multiple vulnerabilities related to insecure component loading and handling, potentially leading to full system compromise.

Executive Summary:
A high-severity vulnerability in Eclipse Theia allows for potential system compromise due to insecure component handling.

Vulnerability Details

CVE-ID: CVE-2026-19884

Affected Software: Eclipse Foundation Eclipse Theia

Affected Versions: 0 up to (excluding) 1.70.0

Vulnerability: The application is susceptible to vulnerabilities involving insecure loading of components, classified under CWE-829 and CWE-15. These flaws can be triggered by an attacker without requiring authentication, though they do require user interaction.

Business Impact

The potential for full system compromise makes this a critical security concern. An attacker could leverage this vulnerability to gain unauthorized control over the development environment or the underlying host, leading to significant data loss or lateral movement. With a CVSS score of 8.4, this vulnerability demands immediate remediation.

Remediation Plan

Immediate Action: Update Eclipse Theia instances to version 1.70.0 or later immediately to incorporate the security fixes.

Proactive Monitoring: Monitor developer workstations and build servers for unauthorized processes or unexpected modifications to the application configuration files.

Compensating Controls: Employ strict endpoint security policies and restrict the ability of Eclipse Theia to execute external components or scripts from untrusted sources.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability was addressed through several pull requests, including 8d67ec4a64515e41bfcbf720011ffaabebe48cf0.

Analyst Recommendation

The severity of this issue necessitates an immediate update across all development environments using Eclipse Theia. Organizations should verify that their specific deployment version is updated to the latest release to eliminate the risk of exploitation.

---METADATA---
VENDOR: Flexi
PRODUCT: Flexi Product Slider and Grid for WooCommerce
AFFECTED_VERSIONS: All versions up to, and including, 1
---END_METADATA---

Description Summary:
The Flexi Product Slider and Grid for WooCommerce plugin is vulnerable to Local File Inclusion (LFI), which could allow attackers to read sensitive system files.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the Flexi Product Slider and Grid plugin could allow attackers to expose sensitive server files and potentially escalate privileges.

Vulnerability Details

CVE-ID: CVE-2026-1988

Affected Software: Flexi Product Slider and Grid for WooCommerce

Affected Versions: All versions up to, and including, 1

Vulnerability: The plugin suffers from a Local File Inclusion (LFI) flaw due to insufficient validation of user-supplied input. This allows an attacker to include and execute local files on the server, potentially exposing sensitive configuration files like wp-config.php.

Business Impact

The exposure of sensitive files can lead to the compromise of database credentials and other secret keys. This information can be leveraged to gain full administrative access to the WordPress site and the underlying server, resulting in data breaches and total system takeover. The CVSS score of 7.5 reflects this high potential for data compromise.

Remediation Plan

Immediate Action: Update the Flexi Product Slider and Grid for WooCommerce plugin to the latest version or remove it if it is no longer required for site functionality.

Proactive Monitoring: Scan server logs for directory traversal patterns (e.g., ../..) targeting the plugin's directory.

Compensating Controls: Implement file system permissions that restrict the web server's ability to read sensitive files outside of the necessary web directories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 15, 2026, there is no public information indicating active exploitation. LFI vulnerabilities are frequently used in the initial stages of a multi-step attack to gather intelligence about the target environment.

Analyst Recommendation

Immediate action is required to patch this LFI vulnerability. Given the risk of sensitive file disclosure, administrators should also consider rotating database passwords and secret keys if there is any suspicion that the vulnerability was previously exploited.

---METADATA---
VENDOR: Roskus
PRODUCT: Prospero Flow CRM
AFFECTED_VERSIONS: 0 up to (excluding) 5.15.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Prospero Flow CRM contains an authorization bypass vulnerability in the payroll module, allowing low-privileged users to access or create cross-tenant payroll data.

Executive Summary:
Roskus Prospero Flow CRM versions prior to 5.15.10 are affected by an authorization bypass vulnerability that permits unauthorized access to sensitive payroll information.

Vulnerability Details

CVE-ID: CVE-2026-19870

Affected Software: Roskus Prospero Flow CRM

Affected Versions: 0 up to (excluding) 5.15.10

Vulnerability: This vulnerability (CWE-639) involves an authorization bypass through a user-controlled key within the payroll module. An attacker with low-level user privileges can manipulate this key to access or modify data belonging to other tenants.

Business Impact

This flaw leads to severe data privacy violations, as it allows cross-tenant access to sensitive financial and payroll records. The potential for unauthorized disclosure or manipulation of payroll data presents significant reputational and legal risks to organizations. The CVSS score of 8.6 reflects the high impact on data confidentiality and integrity.

Remediation Plan

Immediate Action: Upgrade Prospero Flow CRM to version 5.15.10 or higher immediately.

Proactive Monitoring: Audit access logs for the payroll module to identify any unauthorized attempts by users to access records outside of their assigned tenant scope.

Compensating Controls: Implement strict access control lists and review user permissions to ensure that the principle of least privilege is enforced across all CRM modules.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. CISA's SSVC assessment indicates that exploitation is not currently active.

Analyst Recommendation

Organizations using Prospero Flow CRM must treat this as a high-priority update. Because this vulnerability allows for cross-tenant data exposure, the risk of data leakage is substantial, and patching should be performed during the next maintenance window.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: A800R
AFFECTED_VERSIONS: TOTOLINK A800R 4.1.2cu.5137_B20200730
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the TOTOLINK A800R web interface allows remote attackers to achieve arbitrary code execution via the setWiFiWpsConfig function.

Executive Summary:
A critical stack-based buffer overflow in the TOTOLINK A800R router poses a severe risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-19847

Affected Software: TOTOLINK A800R

Affected Versions: TOTOLINK A800R 4.1.2cu.5137_B20200730

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-121) located in the setWiFiWpsConfig function of the wps.so component. An attacker with low-level access can trigger this memory corruption by manipulating the pin argument within the device web interface.

Business Impact

The CVSS score of 8.8 reflects the high potential for system compromise. Successful exploitation allows an attacker to execute arbitrary code with elevated privileges, potentially leading to full device takeover, interception of network traffic, or use of the router as a pivot point for further lateral movement within the internal network.

Remediation Plan

Immediate Action: Since no specific patch version is currently available, contact the vendor for emergency firmware updates or disable the vulnerable Wi-Fi Protected Setup (WPS) feature if possible.

Proactive Monitoring: Review device access logs for unusual administrative activity or repeated attempts to access the WPS configuration endpoints.

Compensating Controls: Implement a Web Application Firewall or restrict access to the web management interface to trusted administrative IP addresses only to reduce the attack surface.

Exploitation Status

Public Exploit Available: Yes, a public exploit has been identified via GitHub.

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation in the wild, though the existence of a public exploit makes the risk of future exploitation high.

Analyst Recommendation

Given the critical severity and the availability of public exploit code, administrators must prioritize hardening these devices. If a firmware update from the vendor becomes available, it should be deployed immediately to address the underlying memory corruption flaw.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: A800R
AFFECTED_VERSIONS: TOTOLINK A800R: 4.1.2cu.5137_B20200730
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability in the TOTOLINK A800R router allows authenticated attackers to trigger memory corruption via the setUrlFilterRules function.

Executive Summary:
A high-severity memory corruption vulnerability in the TOTOLINK A800R router may allow authenticated attackers to disrupt system operations.

Vulnerability Details

CVE-ID: CVE-2026-19846

Affected Software: TOTOLINK A800R

Affected Versions: TOTOLINK A800R: 4.1.2cu.5137_B20200730

Vulnerability: This vulnerability involves a stack-based buffer overflow in the setUrlFilterRules function, requiring the attacker to have low-level privileges to initiate the attack.

Business Impact

The CVSS score of 8.8 reflects the potential for total loss of system availability or unauthorized control. If exploited, an attacker could crash the routing service or execute arbitrary commands, leading to severe network disruption or unauthorized administrative access to the router hardware.

Remediation Plan

Immediate Action: Verify the existence of a firmware update from the vendor and apply it immediately to address the underlying memory corruption flaw.

Proactive Monitoring: Review system logs for unexpected behavior related to URL filtering configurations or administrative configuration changes.

Compensating Controls: Use firewall rules to limit access to the router web management interface to authorized personnel only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable if input validation is missing in the targeted function.

Analyst Recommendation

Given the existence of a proof-of-concept, the risk to the TOTOLINK A800R is credible. Organizations should prioritize updating the firmware to the latest secure version and ensure that administrative access to the device is strictly controlled and audited.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: A800R
AFFECTED_VERSIONS: TOTOLINK A800R: 4.1.2cu.5137_B20200730
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability exists in TOTOLINK A800R that allows an authenticated attacker to trigger memory corruption.

Executive Summary:
A stack-based buffer overflow in the TOTOLINK A800R router poses a significant risk of arbitrary code execution for authenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-19845

Affected Software: TOTOLINK A800R

Affected Versions: TOTOLINK A800R: 4.1.2cu.5137_B20200730

Vulnerability: This vulnerability is caused by a stack-based buffer overflow (CWE-121) and memory corruption (CWE-119) within the device firmware. Successful exploitation requires the attacker to have low-level authenticated access to the device management interface.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting the potential for total compromise of the device's confidentiality, integrity, and availability. Successful exploitation could allow an attacker to gain unauthorized control over the network gateway, potentially facilitating lateral movement, traffic interception, or complete denial of service for the affected network segment.

Remediation Plan

Immediate Action: Contact the vendor to obtain the latest firmware update for the A800R model and apply it immediately to resolve the memory corruption flaw.

Proactive Monitoring: Monitor network traffic for unusual management interface activity and review system logs for signs of unauthorized access or sudden device reboots.

Compensating Controls: Restrict access to the device management interface to trusted administrative IP addresses and disable remote management features if they are not required for business operations.

Exploitation Status

Public Exploit Available: No (no confirmed weaponized exploit or public PoC repository identified).

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its potential for remote code execution.

Analyst Recommendation

Given the high CVSS score and the presence of documented proof-of-concept research, administrators must prioritize the securing of these devices. If a vendor-supplied patch is unavailable, immediately isolate the affected hardware from untrusted network segments to prevent potential exploitation.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: A800R
AFFECTED_VERSIONS: TOTOLINK A800R 4.1.2cu.5137_B20200730
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the TOTOLINK A800R web interface allows remote attackers to execute arbitrary code via the setRadvdCfg function.

Executive Summary:
A critical stack-based buffer overflow in the TOTOLINK A800R router allows authenticated attackers to gain control over device memory and execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-19844

Affected Software: TOTOLINK A800R

Affected Versions: TOTOLINK A800R 4.1.2cu.5137_B20200730

Vulnerability: This vulnerability involves a stack-based buffer overflow (CWE-121) in the setRadvdCfg function within the ipv6.so component. By sending a crafted request to the web interface, a user with low privileges can manipulate the radvdinterfacename argument to trigger memory corruption.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant threat to organizational network integrity. An attacker who successfully exploits this flaw can achieve arbitrary code execution, which could result in the total compromise of the router, leading to unauthorized data access or disruption of network services.

Remediation Plan

Immediate Action: Monitor official vendor communication for a firmware patch to address this memory corruption and apply it immediately upon release.

Proactive Monitoring: Monitor network and device logs for suspicious POST requests targeted at the IPv6 configuration settings of the router.

Compensating Controls: Restrict management interface access to authorized personnel only and disable unnecessary IPv6 services if they are not required for current operations.

Exploitation Status

Public Exploit Available: Yes, a public exploit is currently available.

Analyst Notes: As of August 15, 2026, there is no evidence of active exploitation in the wild, but the presence of a public exploit necessitates prompt protective measures.

Analyst Recommendation

The combination of a high CVSS score and existing public exploit code indicates that this vulnerability is highly dangerous. Organizations should move to isolate the affected devices from external networks until a vendor-supplied patch is successfully deployed.

---METADATA---
VENDOR: WordPress
PRODUCT: SAML Single Sign On
AFFECTED_VERSIONS: 4.8.85 up to (excluding) 5.4.7
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The SAML Single Sign On WordPress plugin contains an improper authentication vulnerability that may allow unauthorized access to the application.

Executive Summary:
An improper authentication vulnerability in the SAML Single Sign On WordPress plugin could permit unauthorized access, creating a significant security risk.

Vulnerability Details

CVE-ID: CVE-2026-19842

Affected Software: WordPress SAML Single Sign On

Affected Versions: 4.8.85 up to (excluding) 5.4.7

Vulnerability: This is an Improper Authentication (CWE-287) vulnerability that potentially allows unauthenticated attackers to bypass security controls within the SAML authentication flow.

Business Impact

A vulnerability in the authentication mechanism of a Single Sign On (SSO) plugin can result in full account takeover or unauthorized access to sensitive administrative functions. With a CVSS score of 8.8, this flaw constitutes a major risk to the overall security posture and data integrity of the WordPress site.

Remediation Plan

Immediate Action: Update the SAML Single Sign On plugin to version 5.4.7 or later to resolve the authentication flaw.

Proactive Monitoring: Review authentication logs for anomalous login attempts or successful logins from unexpected sources that coincide with the use of the SSO plugin.

Compensating Controls: If immediate patching is not feasible, consider disabling SSO functionality and reverting to standard WordPress authentication methods until the update is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of August 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Authentication bypass vulnerabilities are high-value targets for attackers and require immediate attention.

Analyst Recommendation

The severity of this authentication flaw necessitates immediate remediation. Administrators should verify the current version of the SAML Single Sign On plugin and apply the specified update to version 5.4.7 or higher to ensure the integrity of the authentication process.

---METADATA---
VENDOR: alldatacenter
PRODUCT: alldata
AFFECTED_VERSIONS: 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.6.5, 0.6.6, 0.6.7
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The alldatacenter alldata application is vulnerable to insecure deserialization, which could allow unauthenticated remote attackers to execute unauthorized operations.

Executive Summary:
An insecure deserialization vulnerability in alldatacenter alldata versions 0.6.0 through 0.6.7 presents a high risk of unauthorized system manipulation.

Vulnerability Details

CVE-ID: CVE-2026-19826

Affected Software: alldatacenter alldata

Affected Versions: 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.6.5, 0.6.6, 0.6.7

Vulnerability: The software suffers from improper input validation (CWE-20) and insecure deserialization (CWE-502). This allows an unauthenticated remote attacker to provide malicious serialized objects, potentially leading to arbitrary code execution or significant system instability.

Business Impact

The ability for an unauthenticated attacker to exploit deserialization flaws can lead to a full compromise of the application server. With a CVSS score of 7.3, the impact on business operations, including potential data loss or service disruption, is classified as high.

Remediation Plan

Immediate Action: Until a patched version is released by the vendor, users should isolate the affected instances from public-facing networks.

Proactive Monitoring: Monitor system logs for unexpected execution of child processes or errors related to object deserialization, which are often indicators of an attempted exploit.

Compensating Controls: Utilize a WAF to inspect incoming traffic for serialized object signatures or known attack payloads associated with deserialization vulnerabilities.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability's impact is significant due to the nature of deserialization errors in network-accessible services.

Analyst Recommendation

Security teams should immediately assess their exposure to this software. Given the lack of a current patch, strict network segmentation is the most effective temporary measure to prevent exploitation.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Simple Client Management System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
SourceCodester Simple Client Management System 1.0 is vulnerable to SQL injection, allowing unauthenticated remote attackers to compromise database integrity.

Executive Summary:
A critical SQL injection vulnerability in SourceCodester Simple Client Management System 1.0 poses a significant risk of unauthorized data access and manipulation.

Vulnerability Details

CVE-ID: CVE-2026-19825

Affected Software: SourceCodester Simple Client Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) due to improper neutralization of special elements in database queries. This flaw is exploitable by an unauthenticated remote attacker with no user interaction required.

Business Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands, potentially leading to unauthorized data exfiltration, modification of client records, or complete compromise of the backend database. Given the CVSS score of 7.3, this high-severity vulnerability represents a substantial threat to the confidentiality and integrity of sensitive business information.

Remediation Plan

Immediate Action: As no official patch is currently listed, administrators should restrict network access to the application to trusted segments only, or take the service offline until a secure version is provided by the vendor.

Proactive Monitoring: Review database audit logs for anomalous query patterns, such as unexpected syntax or large-scale data extraction attempts, which may indicate active exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious payloads directed at the application.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of this flaw makes it highly attractive for automated scanning and exploitation.

Analyst Recommendation

Given the high severity and the existence of proof-of-concept material, organizations using this software must prioritize securing their environments. Immediately implement network-level access controls and monitor logs while awaiting a formal patch from the vendor.

---METADATA---
VENDOR: Tenda
PRODUCT: W20E
AFFECTED_VERSIONS: Tenda W20E: 15.11.0.6(1068_1546_841)_CN_TDC
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability in Tenda W20E allows an authenticated attacker to cause memory corruption via the device management interface.

Executive Summary:
A stack-based buffer overflow in Tenda W20E firmware creates a critical risk of memory corruption and potential system compromise for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-19824

Affected Software: Tenda W20E

Affected Versions: Tenda W20E: 15.11.0.6(1068_1546_841)_CN_TDC

Vulnerability: The vulnerability is identified as a stack-based buffer overflow (CWE-121) and memory corruption (CWE-119) issue. It requires an attacker to possess valid, low-level credentials to interact with the vulnerable function, after which they can manipulate memory state.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a severe threat to business continuity and network security. Unauthorized manipulation of the router's memory can lead to system instability, unauthorized configuration changes, or the execution of arbitrary commands, effectively granting an attacker control over the edge of the corporate network.

Remediation Plan

Immediate Action: Verify the availability of firmware updates from Tenda and apply the latest version to the W20E gateway to mitigate the buffer overflow risk.

Proactive Monitoring: Review audit logs for suspicious administrative commands and monitor device stability for unexpected crashes that may indicate exploitation attempts.

Compensating Controls: Implement strict network access control lists (ACLs) to ensure only authorized personnel can communicate with the device's management interface.

Exploitation Status

Public Exploit Available: No (no confirmed weaponized exploit or public PoC repository identified).

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. This type of memory corruption flaw is often targeted for remote code execution.

Analyst Recommendation

The severity of this issue necessitates prompt action. Administrators should verify the firmware version currently running on all W20E units and apply vendor-provided updates as soon as they become available to neutralize this attack vector.

---METADATA---
VENDOR: Tenda
PRODUCT: W20E
AFFECTED_VERSIONS: Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda W20E QoS component allows remote attackers to trigger memory corruption via the formQOSRuleDel function.

Executive Summary:
A critical stack-based buffer overflow in the Tenda W20E router allows authenticated attackers to perform unauthorized memory manipulation and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-19823

Affected Software: Tenda W20E

Affected Versions: Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC

Vulnerability: This is a stack-based buffer overflow (CWE-121) vulnerability within the formQOSRuleDel function of the QoS Rule Deletion component. An authenticated attacker can exploit this by providing a specially crafted qosIndex argument, leading to arbitrary code execution.

Business Impact

The CVSS score of 8.8 highlights the severity of this issue. A successful exploit can lead to full system compromise, allowing an attacker to gain control over the router, modify QoS settings to disrupt traffic, or utilize the device as a launchpad for further network attacks.

Remediation Plan

Immediate Action: Await official firmware updates from Tenda and apply them as soon as they are released to remediate the buffer overflow.

Proactive Monitoring: Audit device logs for anomalous requests related to QoS rule management and investigate any unexpected router reboots or configuration changes.

Compensating Controls: Limit access to the web-based management interface to known, secure management subnets to minimize the risk of unauthorized exploitation.

Exploitation Status

Public Exploit Available: Yes, a public exploit has been released.

Analyst Notes: As of August 15, 2026, there is no information regarding active exploitation in the wild, although the availability of a public exploit increases the risk to the organization.

Analyst Recommendation

Given the potential for complete device takeover, this vulnerability should be treated with high urgency. Administrators are advised to restrict management access and apply vendor-provided patches the moment they become available to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Tenda
PRODUCT: W20E
AFFECTED_VERSIONS: 15.11.0.6(1068_1546_841)_CN_TDC
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability in Tenda W20E allows authenticated users to trigger memory corruption via specifically crafted inputs.

Executive Summary:
A high-severity memory corruption vulnerability in Tenda W20E devices poses a significant risk of unauthorized system manipulation and potential service disruption.

Vulnerability Details

CVE-ID: CVE-2026-19822

Affected Software: Tenda W20E

Affected Versions: 15.11.0.6(1068_1546_841)_CN_TDC

Vulnerability: This vulnerability involves a stack-based buffer overflow (CWE-121) and general memory corruption (CWE-119) within the Tenda W20E firmware. It requires an authenticated attacker to provide malicious input to the affected system.

Business Impact

The CVSS score of 8.8 reflects the high potential for impact on confidentiality, integrity, and availability. Successful exploitation could lead to full system compromise or a denial of service condition, potentially disrupting business operations that rely on this networking hardware.

Remediation Plan

Immediate Action: Update the Tenda W20E firmware to the latest available version provided by the manufacturer.

Proactive Monitoring: Monitor system logs for unusual crashes, unexpected reboots, or unauthorized administrative login attempts.

Compensating Controls: Restrict management interface access to trusted network segments and implement strict firewall rules to limit exposure of the device administration panel.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous as it allows for memory corruption.

Analyst Recommendation

Given the high CVSS score and the existence of proof-of-concept materials, administrators must prioritize patching this device. If an official firmware update is not immediately available, isolate the management interface from the network to prevent unauthorized access.

---METADATA---
VENDOR: Tenda
PRODUCT: AC12
AFFECTED_VERSIONS: 15.03.06.23_multi_TD01
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Tenda AC12 router is susceptible to a buffer overflow and memory corruption vulnerability, which can be triggered by an authenticated attacker.

Executive Summary:
An authenticated buffer overflow vulnerability in the Tenda AC12 router could allow an attacker to cause memory corruption, potentially leading to arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-19821

Affected Software: Tenda AC12

Affected Versions: 15.03.06.23_multi_TD01

Vulnerability: The device is vulnerable to buffer overflow (CWE-120) and memory corruption (CWE-119) due to improper input handling. An attacker with authenticated access can exploit these flaws to crash the device or execute arbitrary code.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a severe threat to network infrastructure. Successful exploitation could lead to full device compromise, allowing the attacker to intercept traffic, pivot into the internal network, or cause persistent denial of service, which is particularly damaging for networking equipment.

Remediation Plan

Immediate Action: Check the Tenda support website for the latest firmware release for the AC12 model and apply it immediately. If no update is available, consider isolating the device from the network.

Proactive Monitoring: Monitor the router for unexpected reboots or service instability, which may indicate attempted exploitation of the memory corruption flaw.

Compensating Controls: Disable administrative access from the WAN interface and restrict management access to a dedicated, secure management VLAN or local-only connections.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists in a public GitHub repository (per enrichment.references).

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation, though a proof-of-concept is publicly available. Buffer overflows in firmware are notoriously difficult to defend against without official patches.

Analyst Recommendation

The presence of a public proof-of-concept significantly increases the risk of exploitation for this device. Users should prioritize updating the firmware and enforcing strict network access controls to mitigate the risk until a definitive patch is confirmed and applied.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: A800R
AFFECTED_VERSIONS: 4.1.2cu.5137_B20200730
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability in the TOTOLINK A800R router allows authenticated attackers to execute arbitrary code via the setParentalRules function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the TOTOLINK A800R router allows authenticated attackers to execute arbitrary code, compromising the security of the device.

Vulnerability Details

CVE-ID: CVE-2026-19815

Affected Software: TOTOLINK A800R

Affected Versions: 4.1.2cu.5137_B20200730

Vulnerability: This vulnerability involves a stack-based buffer overflow (CWE-121) within the setParentalRules function, which is susceptible to memory corruption (CWE-119) when processing input from an authenticated user.

Business Impact

Exploitation of this vulnerability allows an attacker to execute arbitrary code on the device, potentially leading to full control over network routing and filtering. With a CVSS score of 8.8, the risk of unauthorized access and potential data interception is high, necessitating urgent remediation.

Remediation Plan

Immediate Action: Update the firmware of all affected TOTOLINK A800R units to the latest version provided by the manufacturer to mitigate this memory corruption vulnerability.

Proactive Monitoring: Monitor system logs for unexpected device reboots or errors associated with parental control rule updates, which could indicate a failed or successful exploit attempt.

Compensating Controls: Limit access to the administrative console and configuration features to authorized personnel and trusted management subnets to prevent unauthorized exploitation.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable in environments where an attacker has obtained low-level authenticated access.

Analyst Recommendation

Given the potential for remote code execution, it is critical to address this vulnerability by applying the vendor-issued firmware patch. Security teams should prioritize this update to ensure the integrity of the network infrastructure and protect against unauthorized device control.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: A800R
AFFECTED_VERSIONS: 4.1.2cu.5137_B20200730
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability in the TOTOLINK A800R router allows authenticated attackers to execute arbitrary code via the setMacQos function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the TOTOLINK A800R router allows authenticated attackers to achieve remote code execution, threatening network integrity.

Vulnerability Details

CVE-ID: CVE-2026-19814

Affected Software: TOTOLINK A800R

Affected Versions: 4.1.2cu.5137_B20200730

Vulnerability: This is a memory corruption flaw (CWE-119, CWE-121) occurring in the setMacQos function, which can be triggered by a specially crafted request from an authenticated user.

Business Impact

Successful exploitation allows an attacker to gain unauthorized control over the network device, potentially leading to unauthorized access to internal network traffic or complete service disruption. The CVSS score of 8.8 highlights the high risk posed to infrastructure stability and organizational security.

Remediation Plan

Immediate Action: Apply the latest firmware security updates provided by TOTOLINK immediately to address this memory corruption flaw.

Proactive Monitoring: Monitor network device logs for crashes or unusual traffic patterns, especially those involving QoS configuration attempts, which may indicate exploitation efforts.

Compensating Controls: Restrict administrative access to the device management interface to trusted internal IP addresses only, reducing the attack surface for potentially malicious authenticated users.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires authentication, but the potential for remote code execution makes it a high priority for remediation.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention from network administrators. Ensure that all TOTOLINK A800R devices are updated to the latest firmware and that administrative access is strictly controlled to prevent exploitation of this buffer overflow.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: A800R
AFFECTED_VERSIONS: TOTOLINK A800R: 4.1.2cu.5137_B20200730
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the setMacFilterRules function of the TOTOLINK A800R router allows remote code execution via manipulation of the Comment argument.

Executive Summary:
A critical stack-based buffer overflow vulnerability in TOTOLINK A800R routers poses a significant risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-19813

Affected Software: TOTOLINK A800R

Affected Versions: TOTOLINK A800R: 4.1.2cu.5137_B20200730

Vulnerability: This is a stack-based buffer overflow vulnerability located in the setMacFilterRules function of the firewall.so component. It requires low-privileged authenticated access to the device to trigger via the Comment argument.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected router. Given the CVSS score of 8.8, this represents a high-severity threat that could lead to full system compromise, unauthorized network access, or the redirection of traffic. Such an event would severely impact business continuity and network integrity.

Remediation Plan

Immediate Action: Contact the vendor for firmware updates, as no specific patch version is currently identified. If no update is available, restrict access to the management interface to trusted administrative subnets.

Proactive Monitoring: Monitor firewall and system access logs for anomalous traffic patterns or repeated attempts to access the cstecgi.cgi script.

Compensating Controls: Implement strict network segmentation and ensure that the administrative interface is not exposed to the public internet or untrusted internal segments.

Exploitation Status

Public Exploit Available: Yes, a public exploit is available via the referenced GitHub repository.

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation in the wild; however, the availability of a public exploit significantly lowers the barrier for potential attackers.

Analyst Recommendation

Due to the critical nature of this memory corruption vulnerability, administrators should prioritize restricting access to the device management interface immediately. Until the vendor provides a patched firmware version, isolating the affected hardware from critical network segments is the most effective way to prevent exploitation.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: A800R
AFFECTED_VERSIONS: TOTOLINK A800R: 4.1.2cu.5137_B20200730
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the UploadCustomModule function of the TOTOLINK A800R router allows remote code execution via manipulation of the File argument.

Executive Summary:
A critical memory corruption flaw in TOTOLINK A800R routers enables remote code execution, requiring immediate attention to mitigate unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-19812

Affected Software: TOTOLINK A800R

Affected Versions: TOTOLINK A800R: 4.1.2cu.5137_B20200730

Vulnerability: This vulnerability is a stack-based buffer overflow within the UploadCustomModule function of the product.so component. It can be triggered remotely by an authenticated user manipulating the File argument.

Business Impact

With a CVSS score of 8.8, this flaw presents a substantial risk to organizational security. An attacker capable of exploiting this memory corruption can gain control over the router, potentially leading to persistent device compromise, data interception, or the establishment of a foothold within the internal network.

Remediation Plan

Immediate Action: Seek guidance from the vendor for potential firmware fixes. In the absence of a direct patch, disable unnecessary features or access to the affected module.

Proactive Monitoring: Review system logs for unusual file upload activity or unexpected process terminations related to the product.so component.

Compensating Controls: Utilize a Web Application Firewall or similar inspection tool to block malicious payloads directed at the /cgi-bin/cstecgi.cgi path.

Exploitation Status

Public Exploit Available: Yes, a public exploit is available via the referenced GitHub repository.

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation in the wild; however, the existence of a public exploit necessitates treating this vulnerability as a high-risk event.

Analyst Recommendation

The severity of this remote code execution vulnerability demands prompt action. Organizations should prioritize the implementation of network-level defenses to prevent unauthorized access to the management interface while awaiting an official firmware update from the vendor.