A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the…

ソフトウェアの欠陥情報を集めて公開するスイスのVulDBは2026年10月24日、中国Unitree Roboticsの犬型ロボット「Go2」で見つかった新たな欠陥（脆弱性）2件を公表した。 FabSceneは2026年 […] The post 国内で実証が進むUnitree「Go2」、脆弱性が相次ぐも一部は未修正のまま first appeared on FabScene（ファブシーン）.

CVE-2026-112302 is a path traversal flaw in the kiwilan php-archive library's ZIP extraction, affecting versions up to 2.3.02. A public exploit is circulating per VulDB. No vendor fix is available; kiwilan has not responded to the disclosure.

CVE-2026-100874 is a remotely exploitable SQL injection flaw in mathurvishal's CloudClassroom-PHP-Project, a PHP web application. A public exploit has been published per VulDB. The project ships as a rolling release and no fixed version is available.

Posted by Christian Fischer on Dec 03 only attaching here as related (not from VulDB CNA) / another example: There was another questionable CVE (CVE-2025-45311) reported against fail2ban which seems to have been turned out to be bogus / nonsense and which has been disputed in the meantime: https://github.com/fail2ban/fail2ban/issues/4110

Posted by Art Manion on Nov 04 The VulDB CNA decided to reject the dnsmasq CVE IDs. I understand both sides of this problem. Would it have helped if the VulDB notification included details such as these (from CVE-2025-12207)? https://shimo.im/docs/vVqRMVMlrycMO63y/read - Art

Posted by Art Manion on Nov 03 I asked VulDB to mark the dnsmasq CVE IDs as disputed. Hello Olle! I was going to do o the same for the Kamailio CVE IDs but defer to the project's decision. If you do decide to dispute, the first request should go to VulDB: https://www.cve.org/PartnerInformation/ListofPartners/partner/VulDB (I accidentally asked the MITRE CNA-LR first.) Regards, - Art

Posted by Alan Coopersmith on Oct 27 Among the new CVE's published this weekend were these from the VulDB CNA: CVE-2025-12198 A vulnerability has been found in dnsmasq up to 2.73rc6. Affected is the function parse_hex of the file src/util.c of the component Config File Handler. The manipulation of the argument i leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be...

VulDB Google Go code to fetch data via API. Contribute to jack69393/vuldb-api-golang-examples development by creating an account on GitHub.

A vulnerability, which was classified as very critical, was found in Netgear DGND3700 1.1.00.15_1.00.15NA. This vulnerability is uniquely identified as CVE-2025-4978. It is recommended to apply restri...

A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. Several companies clearly confirm that VulDB …

💥 Explore this insightful post from Hacker News 📖 📂 Category: 💡 Here’s what you’ll learn: oss-sec mailing list archives From: Moritz Mühlenhoff Date: Mon, 27 Oct 2025 19:21:54 +0000 On Mon, Oct 27, 2025 at 09:34:03AM -0700, Alan Coopersmith wrote: Among the new CVE's published this weekend were these from the VulDB CNA: For all three bugs, the documented "exploit" requires "Replace the default configuration file (/etc/dnsmasq.conf) with the provided malicious file." and if you can replace the server's configuration file you don't need to play games with putting invalid contents in to break the parser, but can simply change the configuration directly.