Reserved but Public CVEs

CVE-2023-47408 is a high-severity command injection vulnerability in the Nagios XI Host Configuration page affecting Nagios XI v5.11.1. According to the provided context, an administrator can inject commands on the Nagios XI server by entering shell commands surrounded by backticks into host/service argument input fields such as $ARG1$ and $ARG2$. The flaw is described as occurring in the Host Configuration workflow, where attacker-controlled argument values are later processed in a way that results in command execution on the Nagios server.

CVE-2023-47408First seen May 31, 2026

CVE-2023-47403 is an authorization flaw in Nagios XI affecting the Missing Objects page. According to the provided context, the page and its associated functionality were accessible to all authenticated users, regardless of whether they held administrator privileges. This indicates missing authorization checks on functionality intended to be restricted to administrators. As a result, a low-privileged authenticated user could access the Missing Objects page and perform actions reserved for administrative users.

CVE-2023-47403First seen May 31, 2026

CVE-2026-40541 is a high-severity vulnerability in Synology Chat Server on DiskStation Manager (DSM). Based on the provided advisory context, the flaw allows remote authenticated users to read or write arbitrary files and to trigger denial-of-service conditions. The specific vulnerable function or code path is not provided in the available content, but the behavior is consistent with improper restriction of file operations on attacker-controlled paths or targets within the application.

CVE-2026-40541First seen May 29, 2026

CVE-2026-9548 is a medium-severity vulnerability in Synology Chat Server affecting deployments on Synology DiskStation Manager (DSM). Based on the provided context, the flaw allows an authenticated attacker to read restricted files and also enables limited denial-of-service actions. No additional technical details about the vulnerable function, root cause, or exact attack vector were provided in the source content.

CVE-2026-9548First seen May 29, 2026

CVE-2026-9491 is a vulnerability in Synology Chat Server on DiskStation Manager (DSM) deployments that exposes non-sensitive information to an authenticated attacker. The provided content does not identify the vulnerable function, endpoint, or root cause, but indicates that the issue was addressed by Synology alongside other Chat Server flaws affecting DSM 7.2.1, 7.2.2, and 7.3 environments.

CVE-2026-9491First seen May 29, 2026

CVE-2026-40710 is a use of hard-coded credentials vulnerability in Dell Container Storage Modules. According to the provided advisory context, default authentication credentials were exposed in public source code, allowing an attacker who knows or can obtain those credentials to authenticate to affected components. The issue stems from embedded default credentials rather than environment-specific secrets management, creating a condition where unauthorized parties can access sensitive system components.

CVE-2026-40710First seen May 28, 2026

CVE-2023-42219First seen Apr 14, 2026

First seen May 5, 2026

First seen May 3, 2026

CVE-2026-35333 is a vulnerability in libradius affecting the processing of RADIUS attributes. According to the provided context, malformed or otherwise crafted RADIUS attributes can trigger either an infinite loop condition or an out-of-bounds read during attribute parsing. The out-of-bounds read may lead to process instability or a crash. Specific vulnerable functions, affected versions, and protocol field details are not available in the provided information.

CVE-2026-35333First seen Apr 22, 2026

CVE-2026-35332 is a vulnerability in libtls affecting processing of ECDH public values in TLS versions prior to 1.3. Based on the available context, malformed or otherwise problematic ECDH public values during the handshake can trigger a crash in the library. Specific vulnerable functions, root cause details, and affected version ranges beyond TLS < 1.3 are not available in the provided content.

CVE-2026-35332First seen Apr 22, 2026

A vulnerability in libstrongswan, specifically involving the pkcs7 plugin, is related to the processing of encrypted PKCS#7 containers. Based on the provided context, malformed or otherwise problematic encrypted PKCS#7 input can trigger a crash during parsing or handling. No further verified details about the exact vulnerable function, root cause, or affected versions were provided in the available content.

CVE-2026-35329First seen Apr 22, 2026

A vulnerability exists in a constraints plugin in the processing of X.509 name constraints. According to the provided context, the plugin can incorrectly accept certificates that violate configured or expected name constraints, resulting in improper certificate validation during authentication. Specific vulnerable functions, affected product/version information, and implementation details are not available in the provided content.

CVE-2026-35331First seen Apr 22, 2026

Available information indicates a vulnerability in the gmp plugin related to RSA decryption that can result in a crash. No further technical details about the affected product, vulnerable code path, root cause, or trigger conditions are currently available from the provided context.

CVE-2026-35334First seen Apr 22, 2026

First seen Apr 22, 2026

CVE-2024-1837First seen Apr 11, 2026

CVE-2021-35400 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, observed on firmware version 20190909. The flaw is in the /cgi-bin/mesh.cgi CGI handler, specifically the code path reached when the HTTP query parameter page=extender is supplied. In get_extender_page, user-controlled input from the key parameter is incorporated into a shell command without proper validation or neutralization. The code reads QUERY_STRING, extracts parameters via web_get, retrieves lan_ipaddr from NVRAM, concatenates lan_ipaddr with the attacker-controlled key value, formats a command of the form echo -n '%s' | md5sum using sprintf, and executes it via popen. Because shell metacharacters in key are not sanitized, an attacker can break out of the intended command context and inject arbitrary shell commands. The injected commands execute in the security context of root.

CVE-2021-35400First seen Apr 11, 2026

CVE-2021-35401 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, tested on firmware version 20190909. The flaw is in /cgi-bin/login.cgi, specifically the sys_login code path reached when the POST parameter page=login and langChange is not equal to "1". In that path, the application reads the attacker-controlled key parameter from the HTTP request body, concatenates it with the stored Password value from NVRAM, formats a shell command using sprintf with the pattern "echo -n '%s' | md5sum", and executes it via popen. Because the key parameter is not properly validated or sanitized before being embedded in a shell command, an attacker can inject shell metacharacters and execute arbitrary commands. The vulnerable process runs with root privileges on the router.

CVE-2021-35401First seen Apr 11, 2026

CVE-2021-35403 is an unauthenticated OS command injection vulnerability in the PROLiNK PRC2402M router, observed on firmware version 20190909. The flaw is in the CGI handler /cgi-bin/touchlist_sync.cgi, where attacker-controlled input from the IP query parameter is incorporated into a shell command that is executed via popen without proper validation or sanitization. The vulnerable code constructs a command of the form "curl -s -m 5 http://%s/cgi-bin/touchlist_sync.cgi?getACL=1" using the supplied IP value and then executes it with popen. Because the IP parameter is not safely constrained, an attacker can inject shell metacharacters and arbitrary commands. The vulnerable path is reachable when getACL is not equal to "1" and the device NVRAM MeshMode value is set to "1" or "2".

CVE-2021-35403First seen Apr 11, 2026

CVE-2021-35407 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, observed on firmware version 20190909. The flaw is in the /cgi-bin/mesh.cgi CGI handler, specifically the code path reached when the page parameter is set to upgrade. In that path, the get_upgrade_page function reads attacker-controlled parameters including key from the HTTP query string, retrieves lan_ipaddr from NVRAM, and constructs a shell command using sprintf with the format string "echo -n '%s' | md5sum". Because the key parameter is not properly validated or sanitized before being incorporated into the command and executed via popen, an attacker can inject shell metacharacters and execute arbitrary commands. The vulnerable endpoint is reachable over HTTP GET and does not require authentication. Successful exploitation results in arbitrary command execution as root on the affected device.

CVE-2021-35407First seen Apr 11, 2026

CVE-2021-35409 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, tested on firmware version 20190909. The flaw is in the CGI endpoint /cgi-bin/nightled.cgi. According to the provided analysis, the script reads HTTP GET parameters from QUERY_STRING and, via setNightLed, retrieves user-controlled values including start_hour, start_min, end_hour, and end_min. These values are duplicated and incorporated with sprintf into the shell command "echo -n %s %s %s %s > /tmp/scheduleSet &", which is then executed through do_system without sufficient input validation or sanitization. Because attacker-controlled input reaches a command-execution sink, a remote attacker can inject arbitrary shell metacharacters and execute commands.

CVE-2021-35409First seen Apr 11, 2026

CVE-2020-25545 affects the Askey AP5100W Wi-Fi mesh node, tested on firmware Dual_SIG_1.01.071. The device web interface exposes functionality to generate and download a configuration backup. According to the provided content, an authenticated attacker can invoke status.cgi with parameters such as service=cfgbackup and act=nvset to create a backup, then retrieve the archive from /configs/config.tar. The downloaded configuration archive contains sensitive information including the web interface administrator password, Wi-Fi password, and other configuration data. The content further states that if a configuration backup already exists, the archive may be retrievable without authentication, regardless of current login state.

CVE-2020-25545First seen Apr 11, 2026

CVE-2020-25546 affects the Askey AP5100W Wi-Fi mesh node web management interface, tested on version Dual_SIG_1.01.071. The authentication implementation is reportedly flawed such that a successful administrator login sets a device-wide authenticated state rather than establishing a per-user session. The report states that no session keys or cookies are used, and once any legitimate user logs into the web interface, subsequent requests from other parties with access to the interface are treated as authenticated. This results in an authentication bypass condition for attackers on the local network or otherwise able to reach the management interface.

CVE-2020-25546First seen Apr 11, 2026

CVE-2021-35408 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, observed on firmware version 20190909. The flaw is in the /cgi-bin/qos.cgi CGI handler. When the page parameter is set to qos_sta, qos.cgi invokes qos_sta_settings, which reads the user-controlled cli_list and cli_num parameters and uses sprintf to construct the shell command '/sbin/sta_qos.sh setup %s %s'. That command string is then passed to system without sufficient input validation or sanitization. Because attacker-controlled input is incorporated directly into a shell command, a remote attacker can submit a crafted HTTP POST request to /cgi-bin/qos.cgi and execute arbitrary commands on the device.

CVE-2021-35408First seen Apr 11, 2026

CVE-2021-35404 is an authenticated OS command injection vulnerability in the Prolink PRC2402M router, observed on firmware version 20190909. The flaw is in the /cgi-bin/applogin.cgi CGI handler. When the api parameter is set to app, applogin.cgi invokes sys_login1, which retrieves user-controlled parameters including ipaddr, password, and lang. After validating the supplied password against the expected MD5 value, the code constructs a shell command using sprintf and executes it via do_system, a wrapper around system. Because the ipaddr and lang parameters are incorporated into the shell command without proper validation or sanitization, an authenticated attacker can inject shell metacharacters and execute arbitrary commands. The injected commands run in the context of the root user.

CVE-2021-35404First seen Apr 11, 2026