Reserved but Public CVEs

CVE-2026-35332 is a vulnerability in libtls affecting processing of ECDH public values in TLS versions prior to 1.3. Based on the available context, malformed or otherwise problematic ECDH public values during the handshake can trigger a crash in the library. Specific vulnerable functions, root cause details, and affected version ranges beyond TLS < 1.3 are not available in the provided content.

CVE-2026-35332First seen Apr 22, 2026

A vulnerability in libstrongswan, specifically involving the pkcs7 plugin, is related to the processing of encrypted PKCS#7 containers. Based on the provided context, malformed or otherwise problematic encrypted PKCS#7 input can trigger a crash during parsing or handling. No further verified details about the exact vulnerable function, root cause, or affected versions were provided in the available content.

CVE-2026-35329First seen Apr 22, 2026

A vulnerability exists in a constraints plugin in the processing of X.509 name constraints. According to the provided context, the plugin can incorrectly accept certificates that violate configured or expected name constraints, resulting in improper certificate validation during authentication. Specific vulnerable functions, affected product/version information, and implementation details are not available in the provided content.

CVE-2026-35331First seen Apr 22, 2026

Available information indicates a vulnerability in the gmp plugin related to RSA decryption that can result in a crash. No further technical details about the affected product, vulnerable code path, root cause, or trigger conditions are currently available from the provided context.

CVE-2026-35334First seen Apr 22, 2026

First seen Apr 22, 2026

CVE-2024-1837First seen Apr 11, 2026

CVE-2021-35400 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, observed on firmware version 20190909. The flaw is in the /cgi-bin/mesh.cgi CGI handler, specifically the code path reached when the HTTP query parameter page=extender is supplied. In get_extender_page, user-controlled input from the key parameter is incorporated into a shell command without proper validation or neutralization. The code reads QUERY_STRING, extracts parameters via web_get, retrieves lan_ipaddr from NVRAM, concatenates lan_ipaddr with the attacker-controlled key value, formats a command of the form echo -n '%s' | md5sum using sprintf, and executes it via popen. Because shell metacharacters in key are not sanitized, an attacker can break out of the intended command context and inject arbitrary shell commands. The injected commands execute in the security context of root.

CVE-2021-35400First seen Apr 11, 2026

CVE-2021-35401 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, tested on firmware version 20190909. The flaw is in /cgi-bin/login.cgi, specifically the sys_login code path reached when the POST parameter page=login and langChange is not equal to "1". In that path, the application reads the attacker-controlled key parameter from the HTTP request body, concatenates it with the stored Password value from NVRAM, formats a shell command using sprintf with the pattern "echo -n '%s' | md5sum", and executes it via popen. Because the key parameter is not properly validated or sanitized before being embedded in a shell command, an attacker can inject shell metacharacters and execute arbitrary commands. The vulnerable process runs with root privileges on the router.

CVE-2021-35401First seen Apr 11, 2026

CVE-2021-35403 is an unauthenticated OS command injection vulnerability in the PROLiNK PRC2402M router, observed on firmware version 20190909. The flaw is in the CGI handler /cgi-bin/touchlist_sync.cgi, where attacker-controlled input from the IP query parameter is incorporated into a shell command that is executed via popen without proper validation or sanitization. The vulnerable code constructs a command of the form "curl -s -m 5 http://%s/cgi-bin/touchlist_sync.cgi?getACL=1" using the supplied IP value and then executes it with popen. Because the IP parameter is not safely constrained, an attacker can inject shell metacharacters and arbitrary commands. The vulnerable path is reachable when getACL is not equal to "1" and the device NVRAM MeshMode value is set to "1" or "2".

CVE-2021-35403First seen Apr 11, 2026

CVE-2021-35407 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, observed on firmware version 20190909. The flaw is in the /cgi-bin/mesh.cgi CGI handler, specifically the code path reached when the page parameter is set to upgrade. In that path, the get_upgrade_page function reads attacker-controlled parameters including key from the HTTP query string, retrieves lan_ipaddr from NVRAM, and constructs a shell command using sprintf with the format string "echo -n '%s' | md5sum". Because the key parameter is not properly validated or sanitized before being incorporated into the command and executed via popen, an attacker can inject shell metacharacters and execute arbitrary commands. The vulnerable endpoint is reachable over HTTP GET and does not require authentication. Successful exploitation results in arbitrary command execution as root on the affected device.

CVE-2021-35407First seen Apr 11, 2026

CVE-2021-35409 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, tested on firmware version 20190909. The flaw is in the CGI endpoint /cgi-bin/nightled.cgi. According to the provided analysis, the script reads HTTP GET parameters from QUERY_STRING and, via setNightLed, retrieves user-controlled values including start_hour, start_min, end_hour, and end_min. These values are duplicated and incorporated with sprintf into the shell command "echo -n %s %s %s %s > /tmp/scheduleSet &", which is then executed through do_system without sufficient input validation or sanitization. Because attacker-controlled input reaches a command-execution sink, a remote attacker can inject arbitrary shell metacharacters and execute commands.

CVE-2021-35409First seen Apr 11, 2026

CVE-2020-25545 affects the Askey AP5100W Wi-Fi mesh node, tested on firmware Dual_SIG_1.01.071. The device web interface exposes functionality to generate and download a configuration backup. According to the provided content, an authenticated attacker can invoke status.cgi with parameters such as service=cfgbackup and act=nvset to create a backup, then retrieve the archive from /configs/config.tar. The downloaded configuration archive contains sensitive information including the web interface administrator password, Wi-Fi password, and other configuration data. The content further states that if a configuration backup already exists, the archive may be retrievable without authentication, regardless of current login state.

CVE-2020-25545First seen Apr 11, 2026

CVE-2020-25546 affects the Askey AP5100W Wi-Fi mesh node web management interface, tested on version Dual_SIG_1.01.071. The authentication implementation is reportedly flawed such that a successful administrator login sets a device-wide authenticated state rather than establishing a per-user session. The report states that no session keys or cookies are used, and once any legitimate user logs into the web interface, subsequent requests from other parties with access to the interface are treated as authenticated. This results in an authentication bypass condition for attackers on the local network or otherwise able to reach the management interface.

CVE-2020-25546First seen Apr 11, 2026

CVE-2021-35408 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, observed on firmware version 20190909. The flaw is in the /cgi-bin/qos.cgi CGI handler. When the page parameter is set to qos_sta, qos.cgi invokes qos_sta_settings, which reads the user-controlled cli_list and cli_num parameters and uses sprintf to construct the shell command '/sbin/sta_qos.sh setup %s %s'. That command string is then passed to system without sufficient input validation or sanitization. Because attacker-controlled input is incorporated directly into a shell command, a remote attacker can submit a crafted HTTP POST request to /cgi-bin/qos.cgi and execute arbitrary commands on the device.

CVE-2021-35408First seen Apr 11, 2026

CVE-2021-35404 is an authenticated OS command injection vulnerability in the Prolink PRC2402M router, observed on firmware version 20190909. The flaw is in the /cgi-bin/applogin.cgi CGI handler. When the api parameter is set to app, applogin.cgi invokes sys_login1, which retrieves user-controlled parameters including ipaddr, password, and lang. After validating the supplied password against the expected MD5 value, the code constructs a shell command using sprintf and executes it via do_system, a wrapper around system. Because the ipaddr and lang parameters are incorporated into the shell command without proper validation or sanitization, an authenticated attacker can inject shell metacharacters and execute arbitrary commands. The injected commands run in the context of the root user.

CVE-2021-35404First seen Apr 11, 2026

First seen Mar 18, 2026

A reflected cross-site scripting (XSS) vulnerability exists in Invision Community software, specifically in the /oauth/callback/index.php script. The vulnerability is present in certain 4.x versions before 4.7.21 and all 5.x versions before 5.0.8. It arises due to insufficient sanitization of user input passed via the 'state' POST parameter, allowing attackers to inject and execute arbitrary JavaScript in the context of a victim's browser if they can trick the victim into submitting a crafted request.

CVE-2025-48933First seen Mar 18, 2026

First seen Oct 8, 2026

First seen Oct 8, 2026

First seen Oct 8, 2026

First seen Oct 8, 2026

First seen Oct 8, 2026

First seen Oct 8, 2026

First seen Oct 8, 2026

First seen Oct 8, 2026