Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownRed Hat Product Security has come to the conclusion that this CVE is not needed.Open the advisoryMay 1, 2025
- Medium6.0The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirect_uri was on theCheck if you run itEPSS 0.32%May 1, 2025
- High8.7A vulnerability, which was classified as critical, has been found in Netgear EX6200 1.0.3.94.Check if you run itEPSS 1.20%May 1, 2025
- Critical9.0LibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments_list references, leading to a use-after-free, and allowing remote attackers to execute arbitrarCheck if you run itEPSS 0.68%May 1, 2025
- High7.1An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices.Check if you run itEPSS 0.33%May 1, 2025
- High8.2Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenticate to the web managCheck if you run itEPSS 0.17%May 1, 2025
- High8.2Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the client and server byCheck if you run itEPSS 0.26%May 1, 2025
- Medium6.5Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information about or more easily decrypt encrypted mCheck if you run itEPSS 0.32%May 1, 2025
- Medium6.5Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to the router's OS by sendiCheck if you run itEPSS 7.52%May 1, 2025
- Medium6.5Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable 'ate' (a remote system management binary)Check if you run itEPSS 0.41%May 1, 2025
- Medium6.5Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes forCheck if you run itEPSS 0.85%May 1, 2025
- High7.3Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shell access to the devicCheck if you run itEPSS 1.00%May 1, 2025
- High8.2Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the telnet service by calculating the root password based on easily-oCheck if you run itEPSS 0.43%May 1, 2025
- High7.3Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt, replay, anCheck if you run itEPSS 0.23%May 1, 2025
- High8.8Lack of input validation/sanitization in the 'setLanCfg' API endpoint in httpd in the Tenda RX2 Pro 16.03.30.14 allows a remote attacker that is authorized to the web management poCheck if you run itEPSS 0.85%May 1, 2025
- Medium6.3Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter.Check if you run itEPSS 1.18%May 1, 2025
- Medium6.3Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter.Check if you run itEPSS 1.17%May 1, 2025
- Medium6.3Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter.Check if you run itEPSS 1.17%May 1, 2025
- Medium6.3Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter.Check if you run itEPSS 1.17%May 1, 2025
- Medium6.5TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Url parameter.Check if you run itEPSS 0.87%May 1, 2025
- Medium6.3TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter.Check if you run itEPSS 0.94%May 1, 2025
- Medium6.3TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter.Check if you run itEPSS 0.94%May 1, 2025
- Medium6.5TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Port parameter.Check if you run itEPSS 0.87%May 1, 2025
- Medium6.3TOTOLINK CP900 V6.3c.1144_B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter.Check if you run itEPSS 0.94%May 1, 2025
- Medium6.3TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter.Check if you run itEPSS 0.94%May 1, 2025
Sort