Vulnerabilities
Summary — last 7 days
New vulnerabilities2,740▼ 482 vs. last week
Critical / high1,306▼ 184 vs. last week
New active exploitation (KEV)3▼ 5 vs. last week
Unscored (no CVSS)226▼ 276 vs. last week
610 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (8.6) | 2.3% | — | Draytek VigorswitchAI | 8/24/2026 | 8/26/2026 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands… | |
| Deferred | High (8.6) | 2.3% | — | Draytek VigorswitchAI | 8/24/2026 | 8/26/2026 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands… | |
| Deferred | High (8.6) | 2.3% | — | Draytek VigorswitchAI | 8/24/2026 | 8/26/2026 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands… | |
| Deferred | High (8.6) | 2.3% | — | Draytek VigorswitchAI | 8/24/2026 | 8/27/2026 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute… | |
| Deferred | High (8.6) | 2.3% | — | Draytek VigorswitchAI | 8/24/2026 | 8/26/2026 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands… | |
| Deferred | High (8.6) | 2.3% | — | Draytek VigorswitchAI | 8/24/2026 | 8/26/2026 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with… | |
| Deferred | High (8.6) | 2.3% | — | Draytek VigorswitchAI | 8/24/2026 | 8/26/2026 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands… | |
| Deferred | High (8.7) | 0.69% | — | Draytek VigorswitchAI | 8/24/2026 | 8/26/2026 | Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a… | |
| Deferred | Critical (9.3) | 2.8% | — | Draytek VigorswitchAI | 8/24/2026 | 8/27/2026 | Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary… | |
| Deferred | Medium (6.9) | 0.56% | — | Draytek VigorswitchAI | 8/24/2026 | 8/26/2026 | Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to crash the service and… | |
| Deferred | High (8.6) | 2.3% | — | Draytek VigorswitchAI | 8/24/2026 | 8/26/2026 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary… | |
| Deferred | High (8.6) | 2.3% | — | Draytek VigorswitchAI | 8/24/2026 | 8/26/2026 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to… | |
| Deferred | High (8.6) | 2.3% | — | Draytek VigorswitchAI | 8/24/2026 | 8/26/2026 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root… | |
| Deferred | High (8.6) | 1.8% | — | Draytek VigorswitchAI | 8/24/2026 | 8/27/2026 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quotes in the parameter field. A remote attacker can trigger this vulnerability via… | |
| Deferred | High (8.6) | 2.3% | — | Draytek VigorswitchAI | 8/24/2026 | 8/26/2026 | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary… | |
| Awaiting Analysis | Medium (5.4) | 0.27% | — | Cisco Industrial Ethernet 1000 Series SwitchesAI | 8/19/2026 | 8/20/2026 | A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input… | |
| Awaiting Analysis | Medium (5.3) | 0.51% | — | Cisco Industrial Ethernet 1000 Series SwitchesAI | 8/19/2026 | 8/20/2026 | A vulnerability in the handling of management plane packets by Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an unauthenticated, remote attacker to cause the device manager, SSH, or API to become inaccessible.This vulnerability is due to insufficient protection against management plane flooding… | |
| Analyzed | Medium (6.8) | 0.26% | — | Samsung Smart Switch | 8/10/2026 | 8/19/2026 | Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. | |
| Analyzed | Medium (6.9) | 0.17% | — | Samsung Smart Switch | 8/10/2026 | 8/19/2026 | Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. | |
| Analyzed | High (7) | 0.10% | — | Samsung Smart Switch | 8/10/2026 | 8/19/2026 | Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data. | |
| Analyzed | Medium (4.7) | 0.16% | — | Samsung Smart Switch | 8/10/2026 | 8/19/2026 | Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity. | |
| Deferred | Medium (6.1) | 0.25% | — | FS INC S3150-8t2f SwitchAI | 7/31/2026 | 9/9/2026 | A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL. | |
| Deferred | High (7.5) | 0.32% | — | Customer SwitchingAI | 7/30/2026 | 7/30/2026 | The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an… | |
| Deferred | High (7) | 0.40% | — | Sangoma Switchvox SMB EditionAI | 7/17/2026 | 7/17/2026 | A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript supplied… | |
| Deferred | High (7.1) | 0.38% | — | Sangoma Switchvox SMB EditionAI | 7/17/2026 | 7/17/2026 | An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an… |