Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2970▼ 106 respecto a la semana anterior
Críticas / altas1447▲ 86 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)350▼ 160 respecto a la semana anterior
8 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Pendiente de análisis | Media (6.9) | 0.57% | — | Planet Gs-4210-16p2sAI | 28/8/2026 | 8/9/2026 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web_login_first_post handler copies the usrPass POST parameter into a fixed-size stack buffer without length validation, the web_sys_enablePasswd_post handler copies the… | |
| Pendiente de análisis | Media (6.9) | 0.60% | — | Planet Gs-4210-16p2sAI | 28/8/2026 | 8/9/2026 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The web_radiusSrv*_post family of handlers copies the radKey, radKey_0, radDftParamKey, radName, and radIp POST parameters into fixed-size stack… | |
| Pendiente de análisis | Media (6.9) | 0.60% | — | Planet Gs-4210-16p2sAI | 28/8/2026 | 8/9/2026 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy attacker-controlled POST parameters into fixed-size stack buffers without length validation: web_vlan_membership_edit_dialog_post;… | |
| Pendiente de análisis | Media (6.9) | 0.56% | — | Planet Gs-4210-16p2sAI | 28/8/2026 | 8/9/2026 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_alive_rmtip_post handler dereferences the rmtIP parameter without verifying its presence. A remote authenticated attacker can send a crafted request omitting the… | |
| Pendiente de análisis | Alta (8.7) | 0.71% | — | Planet Gs-4210-16p2sAI | 28/8/2026 | 8/9/2026 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_query_string to process attacker-controlled… | |
| Pendiente de análisis | Alta (8.6) | 1.5% | — | Planet Gs-4210-16p2sAI | 28/8/2026 | 8/9/2026 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test_post handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with administrator web… | |
| Pendiente de análisis | Alta (8.6) | 0.94% | — | Planet Gs-4210-16p2sAI | 28/8/2026 | 8/9/2026 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A remote attacker with… | |
| Pendiente de análisis | Alta (8.6) | 1.5% | — | Planet Gs-4210-16p2sAI | 28/8/2026 | 8/9/2026 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_vlan_membership_edit_dialog_post handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated attacker can send a… |