Microsoft April 2026 Security Updates

Microsoft March 2026 Security Updates

Microsoft March 2026 Early Security Updates

Microsoft February 2026 Security Updates

Microsoft January 2026 Security Updates

Microsoft December 2025 Security Updates

Microsoft December 2025 Early Security Updates

Microsoft November 2025 Security Updates

Microsoft October 2025 Security Updates

Microsoft September 2025 Security Updates

Microsoft August 2025 Security Updates

Microsoft August Early 2025 Security Updates

Microsoft July 2025 Security Updates

Microsoft June 2025 Security Updates

Microsoft June Early 2025 Security Updates

Microsoft May 2025 Security Updates

Microsoft May Early 2025 Security Updates

Microsoft April 2025 Security Updates

Microsoft March 2025 Security Updates

Microsoft March 2025 Early Security Updates

Microsoft February 2025 Security Updates

Microsoft February 2025 Early Security Updates

Microsoft January 2025 Security Updates

Microsoft January 2025 Early Security Updates

Microsoft December 2024 Security Updates

Microsoft November 2024 Security Updates

Microsoft October 2024 Security Updates

Microsoft September 2024 Security Updates

Microsoft August 2024 Security Updates

Microsoft July 2024 Security Updates

Microsoft June 2024 Security Updates

Microsoft May 2024 Security Updates

Microsoft April 2024 Security Updates

Microsoft March 2024 Security Updates

Microsoft February 2024 Security Updates

Microsoft January 2024 Security Updates

cpanel

wp_squared

Missing Authentication for Critical Function

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

cPanel & WHM

WP Squared

cPanel, L.L.C.

An authentication bypass vulnerability exists in the login flow of cPanel and WHM versions after 11.40. This vulnerability allows unauthenticated remote attackers to bypass authentication mechanisms and gain unauthorized access to the control panel without providing valid credentials.

Choosing Message Identifier

Force the System to Reset Values

Using Unpublished Interfaces

Cross Site Request Forgery

Github Advisory

support.cpanel.net

Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Out-of-bounds Write

A security vulnerability has been detected in Edimax BR-6428nC up to 1.16. This impacts an unknown function of the file /goform/setWAN. Such manipulation of the argument pptpDfGateway  leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

BR-6428nC

Edimax

A buffer overflow vulnerability exists in Edimax BR-6428nC firmware versions up to 1.16 in the /goform/setWAN endpoint. The vulnerability is triggered through improper handling of the pptpDfGateway parameter, which fails to validate input size before copying data into a fixed-size buffer, resulting in an out-of-bounds write condition.

Buffer Overflow via Environment Variables

Overflow Buffers

Buffer Manipulation

Client-side Injection-induced Buffer Overflow

Filter Failure through Buffer Overflow

MIME Conversion

Overflow Binary Resource File

Buffer Overflow via Symbolic Links

Overflow Variables and Tags

Buffer Overflow via Parameter Expansion

Buffer Overflow in an API Call

Buffer Overflow in Local Command-Line Utilities

String Format Overflow in syslog()

Forced Integer Overflow

A vulnerability was detected in Edimax BR-6208AC up to 1.02. Affected is an unknown function of the file /goform/setWAN. Performing a manipulation of the argument pptpDfGateway  results in buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

BR-6208AC

A buffer overflow vulnerability exists in Edimax BR-6208AC up to version 1.02 in an unknown function of the file /goform/setWAN. The vulnerability is triggered through manipulation of the pptpDfGateway argument, resulting in a classic buffer overflow condition. This is classified as improper restriction of operations within memory buffer bounds.

A vulnerability has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. Impacted is the function start_lan of the file /apply.cgi. The manipulation of the argument Channel/ApCliSsid leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

LBT-T300-HW1

Shenzhen Libituo Technology

A buffer overflow vulnerability exists in Shenzhen Libituo Technology LBT-T300-HW1 up to version 1.2.8. The vulnerability is located in the start_lan function of the /apply.cgi file, where the Channel/ApCliSsid parameter is not properly validated before being processed. This improper restriction of operations within memory buffer bounds allows for classic buffer overflow attacks via CWE-119 and CWE-120.

A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. This issue affects the function start_single_service of the component Web Management Interface. Executing a manipulation of the argument vpn_pptp_server/vpn_l2tp_server can lead to buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A buffer overflow vulnerability exists in Shenzhen Libituo Technology LBT-T300-HW1 up to version 1.2.8. The vulnerability is located in the start_single_service function of the Web Management Interface. Exploitation occurs through manipulation of the vpn_pptp_server or vpn_l2tp_server arguments, resulting in a buffer overflow condition.

linux_kernel

kernel

Improper Validation of Consistency within Input

Incorrect Resource Transfer Between Spheres

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_aead - Revert to operating out-of-place

This mostly reverts commit 72548b093ee3 except for the copying of
the associated data.

There is no benefit in operating in-place in algif_aead since the
source and destination come from different mappings.  Get rid of
all the complexity added for in-place operation and just copy the
AD directly.

Linux

A buffer handling flaw in the Linux kernel's AEAD (Authenticated Encryption with Associated Data) cipher interface (algif_aead) in the crypto subsystem allows local attackers with low privileges to write to arbitrary kernel memory. The vulnerability exists in how the kernel handles in-place cryptographic operations where source and destination memory mappings differ, leading to improper buffer validation and data corruption.

bugzilla.redhat.com

git.kernel.org

www.openwall.com

wordpress

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via POST parameter key names in the submit_nex_form() function in versions up to, and including, 9.1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NEX-Forms – Ultimate Forms Plugin for WordPress

webaways

The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via POST parameter key names in the submit_nex_form() function in versions up to and including 9.1.11. The vulnerability exists due to insufficient input sanitization and output escaping, allowing malicious scripts to be injected into pages.

XSS Using MIME Type Mismatch

DOM-Based XSS

Reflected XSS

Stored XSS

Cross-Site Scripting (XSS)

AJAX Footprinting

mina

Deserialization of Untrusted Data

The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description:











Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.




The fix checks if the class is present in the accepted class filter before calling Class.forName(). 






Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6.





The problem is resolved in Apache MINA 2.1.12, and 2.2.7 by 
applying the classname allowlist earlier.





Affected are applications using Apache MINA that call  IoBuffer.getObject().





Applications using Apache MINA are advised to upgrade.

Apache MINA

Apache Software Foundation

Classname allowlist bypass in Apache MINA's AbstractIoBuffer.resolveClass() method. The fix for a previous vulnerability (CVE-2026-41635) was not applied to the 2.1.X and 2.2.X branches. One code branch (for static classes or primitive types) does not check the class against the allowlist before calling Class.forName(), allowing arbitrary code execution through deserialization. Affected versions: Apache MINA 2.1.0 through 2.1.11, and 2.2.0 through 2.2.6. Applications using Apache MINA that call IoBuffer.getObject() are vulnerable.

Object Injection

lists.apache.org

Search CVEs by ID

Trending Vulnerabilities

Latest Patch Tuesday Reports

April 2026 Patch Tuesday: 10 Critical Vulnerabilities Amid 165 CVEs

March 2026 Patch Tuesday: 10 Critical Vulnerabilities Amid 96 CVEs

March 2026 Early Security Update: 2 Critical Vulnerabilities Amid 5 CVEs

Browse

Be the first to know about critical vulnerabilities