Hardware

A security vulnerability in the Unitree Go2 component chat_go allows for remote OS command injection via the set_volume function.

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 contain hard-coded credentials that allow a physically proximate attacker to gain elevated administrative privileges.

Multiple D-Link router models contain hard-coded credentials in the MQTT Broker component, allowing for potential remote unauthorized access via public exploit code.

Multiple high-severity vulnerabilities in HPE Networking AOS-Switch could allow unauthenticated attackers to achieve remote code execution, perform unauthorized actions, or cause denial of service.

The LTSecurity LTK3500SF device stores root and guest account credentials in a recoverable format, allowing attackers to gain full administrative access via SSH or Telnet.

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability (CVE-2026-71921) in the setget.cgi interface that allows unauthenticated remote attackers to execute arbitrary commands as root.

IBM Power Systems Firmware contains a stack-based buffer overflow in the ASMI web interface, allowing an unauthenticated attacker to achieve arbitrary code execution on the Flexible Service Processor.

Multiple D-Link NAS devices are vulnerable to unauthenticated OS command injection via the account_mgr.cgi script, allowing remote attackers to execute arbitrary commands with root privileges.

An information disclosure vulnerability in AMD Zen processors allows an authorized local attacker to access sensitive information.

A potential out-of-bounds memory vulnerability in the NXP i.MX 8 Image Signal Processor (ISI) driver could lead to system instability or memory corruption if triggered by an attacker with driver-level access.

Multiple vulnerabilities in the Cisco Integrated Management Controller allow remote, authenticated attackers to perform Cross-Site Scripting or execute arbitrary code with root privileges.

A command injection vulnerability exists in MeiG Smart FORGE_SLT711, as demonstrated by a public exploit, posing a high risk to unpatched systems.

A hardware exploit has been published on Exploit-DB for D-Link DSL2600U, detailing a 'rom-0' Admin Password Disclosure vulnerability that allows unauthorized access to the device's administration interface.

A stack buffer overflow vulnerability in Linksys E1200 firmware version 2.0.04 and earlier allows an authenticated attacker to achieve remote code execution by sending a crafted HTTP POST request to the apply.cgi endpoint.