Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 08:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

181-70% vs 7-day avg of 598

2 critical, 65 high, 73 medium, 31 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	8.7	CVE-2026-93489	Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to... ASUSASUS Router	NVD	Oct 23 08:16 UTC
CVE-2026-93489Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to... Executive summary The advisory describes an authentication flaw in ASUS router modules that could let a nearby, unauthenticated user forge an access ticket with a crafted HTTP request. The advisory text is truncated and does not state a severity score, affected versions, or a fix from the vendor in the copied content. Defenders should check the full ASUS advisory page for affected models, patch status, and recommended actions. Technical summary The flaw is classified as improper authentication in ASUS router modules, and the advisory states an unauthenticated nearby user can send an HTTP request to forge an access ticket, which then enables further actions (the text is cut off after this point). The attack vector is stated as nearby and requires no authentication; other preconditions are not stated. Affected product names, model numbers, and version numbers are not stated in the copied text. Fixed versions are not stated. Workarounds are not stated. A CVSS score is not stated in the copied text, although the page says ASUS uses CVSS scoring generally. No detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from asus.com/security-advisory Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ASUS ASUS Router NIST National Vulnerability DatabasePublished Oct 23, 2026 08:16 UTC Read the advisory
	High	8.6	CVE-2026-75779	Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to... ASUSASUS Router	NVD	Oct 23 08:16 UTC
CVE-2026-75779Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to... Executive summary The advisory describes an OS command injection and cross-site request forgery flaw in an unnamed ASUS router model. The text is truncated and does not state a severity rating, affected versions, or a fix, so the advisory does not say how serious it is or what the vendor recommends beyond general advice to keep products updated. Technical summary The flaw is classified as improper neutralization of special elements used in an OS command (OS command injection), combined with cross-site request forgery (CSRF), in an ASUS router model. The text is cut off at the point where it describes what an attacker can do, so the attack vector and preconditions are not stated. Affected router model names, affected firmware versions, and fixed versions are not stated. No CVSS score is given for this CVE in the advisory text, and no workaround or detection guidance is stated. The surrounding ASUS page is general policy text and does not provide product-specific remediation details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from asus.com/security-advisory Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Active CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ASUS ASUS Router NIST National Vulnerability DatabasePublished Oct 23, 2026 08:16 UTC Read the advisory
	High	7.7	CVE-2026-75775	Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted... ASUSASUS Router	NVD	Oct 23 08:16 UTC
CVE-2026-75775Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted... Executive summary An OS command injection flaw in certain ASUS routers allows a remote user to run arbitrary commands with root privileges, according to the advisory text provided. The advisory text provided does not name specific router models, affected firmware versions, or a severity score, so the scope and urgency beyond this cannot be confirmed from it. The text provided does not state a specific vendor fix or recommended action for this CVE beyond general advice to keep products updated with the latest firmware. Technical summary The flaw is classified as improper neutralization of special elements used in an OS command (command injection). The advisory describes remote exploitation via crafted input that results in execution of arbitrary commands with root privileges, but the specific crafted request, endpoint, or parameter is truncated and not stated. Affected router models and firmware versions are not stated, and no fixed version is given. No workaround and no detection guidance specific to this CVE are stated, and the CVSS score is not stated in the text provided. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from asus.com/security-advisory Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ASUS ASUS Router NIST National Vulnerability DatabasePublished Oct 23, 2026 08:16 UTC Read the advisory
	Medium	5.3	CVE-2026-75753	Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to... ASUSASUS Router	NVD	Oct 20 02:17 UTC
CVE-2026-75753Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to... From the advisory Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal conditions, it may be unable to perform self-recovery. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ASUS ASUS Router NIST National Vulnerability DatabasePublished Oct 20, 2026 02:17 UTC Read the advisory
	High	8.2	CVE-2026-17518	Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an... ASUSASUS Router	NVD	Oct 20 02:17 UTC
CVE-2026-17518Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an... From the advisory Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ASUS ASUS Router NIST National Vulnerability DatabasePublished Oct 20, 2026 02:17 UTC Read the advisory
	Critical	9.3	CVE-2026-14911	Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router... ASUSASUS Router	NVD	Oct 7 03:16 UTC
CVE-2026-14911Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router... From the advisory Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ASUS ASUS Router NIST National Vulnerability DatabasePublished Oct 7, 2026 03:16 UTC Read the advisory
	High	7.7	CVE-2026-19396	A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user... ASUSASUS Router	NVD	Oct 7 02:16 UTC
CVE-2026-19396A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user... From the advisory A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing session.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ASUS ASUS Router NIST National Vulnerability DatabasePublished Oct 7, 2026 02:16 UTC Read the advisory
	Critical	9.3	CVE-2026-19386	A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the... ASUSASUS Router	NVD	Oct 7 02:16 UTC
CVE-2026-19386A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the... From the advisory A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ASUS ASUS Router NIST National Vulnerability DatabasePublished Oct 7, 2026 02:16 UTC Read the advisory
	High	8.4	CVE-2026-16528	Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log,... ASUSASUS Router	NVD	Oct 7 02:16 UTC
CVE-2026-16528Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log,... From the advisory Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Adjacent network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ASUS ASUS Router NIST National Vulnerability DatabasePublished Oct 7, 2026 02:16 UTC Read the advisory
	Critical	9.4	CVE-2026-14157	Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the... ASUSASUS Router	NVD	Oct 1 02:16 UTC
CVE-2026-14157Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the... From the advisory Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ASUS ASUS Router NIST National Vulnerability DatabasePublished Oct 1, 2026 02:16 UTC Read the advisory
	High	8.9	CVE-2026-13313	An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the... ASUSASUS Router	NVD	Oct 1 02:16 UTC
CVE-2026-13313An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the... From the advisory An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected to the router. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ASUS ASUS Router NIST National Vulnerability DatabasePublished Oct 1, 2026 02:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects