CVE ID :CVE-2026-71956 Published : Aug. 8, 2026, 6:16 p.m. | 1 hour, 41 minutes ago Description :D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject…
CVE ID :CVE-2026-71957 Published : Aug. 8, 2026, 6:16 p.m. | 1 hour, 41 minutes ago Description :D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write…
CVE ID :CVE-2026-71958 Published : Aug. 8, 2026, 6:16 p.m. | 1 hour, 41 minutes ago Description :D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write…
CVE ID :CVE-2026-71954 Published : Aug. 8, 2026, 5:16 p.m. | 2 hours, 41 minutes ago Description :D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can…
CVE ID :CVE-2026-71955 Published : Aug. 8, 2026, 5:16 p.m. | 2 hours, 41 minutes ago Description :D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject…
CVE ID :CVE-2026-71851 Published : Aug. 7, 2026, 7:18 p.m. | 30 minutes ago Description :crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom…
CVE ID :CVE-2026-71847 Published : Aug. 7, 2026, 7:18 p.m. | 30 minutes ago Description :Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby’s JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start,…
A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. “These packages appear to use AI slop squatted, or…
ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script that profiles…
CVE ID :CVE-2026-64638 Published : Aug. 7, 2026, 6:17 p.m. | 1 hour, 32 minutes ago Description :WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it…