CVE-2026-1327
published 2026-01-22CVE-2026-1327: A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file…
PriorityP274high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
2.65%
83.9th percentile
A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| msrc | azure_iot_explorer | — | — |
| openclaw | openclaw | >= 2026.1.14-1 < 2026.2.12 | 2026.2.12 |
| totolink | nr1800x | — | — |
| totolink | nr1800x_firmware | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat8.8HIGH
vendor_msrc6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
wlc: print_html outputs API data without HTML escaping
ghsa·2026-04-24
CVE-2026-42150 [MEDIUM] CWE-79 wlc: print_html outputs API data without HTML escaping
wlc: print_html outputs API data without HTML escaping
### Impact
The HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser.
### Patches
* https://github.com/WeblateOrg/wlc/pull/1327
### Workarounds
The only vulnerable code path is HTML output which is opt-in.
### References
Weblate thanks @fg0x0 for reporting this on GitHub.
GHSA
Apache IoTDB has an Insecure Default Configuration Vulnerability
ghsa·2026-03-09
CVE-2026-24015 [CRITICAL] CWE-1327 Apache IoTDB has an Insecure Default Configuration Vulnerability
Apache IoTDB has an Insecure Default Configuration Vulnerability
A vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.
Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.
GHSA
OpenClaw's Chrome extension relay binds publicly due to wildcard treated as loopback
ghsa·2026-02-17
CVE-2026-28395 [MEDIUM] CWE-1327 OpenClaw's Chrome extension relay binds publicly due to wildcard treated as loopback
OpenClaw's Chrome extension relay binds publicly due to wildcard treated as loopback
## Summary
The Chrome extension relay (`ensureChromeExtensionRelayServer`) previously treated wildcard hosts (`0.0.0.0` / `::`) as loopback, which could make it bind the relay HTTP/WS server to all interfaces when a wildcard `cdpUrl` was passed.
## Impact
If configured with a wildcard `cdpUrl`, relay HTTP endpoints could become reachable off-host, leaking service presence/port and enabling DoS/brute-force traffic against the relay token header.
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `>= 2026.1.14-1 = 2026.2.12` (released 2026-02-13)
## Fix Commit(s)
- 8d75a496bf5aaab1755c56cf48502d967c75a1d0
## Notes
- Earlier hardening for `/json*` auth and `/cdp` token checks landed
GHSA
GHSA-vcr6-rc5m-f5w2: A security vulnerability has been detected in Totolink NR1800X 9
ghsa_unreviewed·2026-01-22
CVE-2026-1327 [MEDIUM] CWE-74 GHSA-vcr6-rc5m-f5w2: A security vulnerability has been detected in Totolink NR1800X 9
A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Red Hat
golang.org/x/tools/gopls: golang: gopls: Arbitrary code execution due to insecure network binding
vendor_redhat·2026-05-06·CVSS 8.8
CVE-2026-42503 [HIGH] CWE-1327 golang.org/x/tools/gopls: golang: gopls: Arbitrary code execution due to insecure network binding
golang.org/x/tools/gopls: golang: gopls: Arbitrary code execution due to insecure network binding
gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.
If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0.
As a result, users might inadvertently cause gopls to bind 0.0.0.0.
This can allow a malicious party on the same network to execute code arbitrarily via gopls.
A flaw was found in gopls. When started with -listen using a hostless address (for example :8080) or with -port, the language server binds to 0.0.0.0 instead of localhost, exposing the debug interface to the local network and allowing arbitrary code execution by a malicious party on the same network.
Statement: g
Microsoft
Azure IoT Explorer Information Disclosure Vulnerability
vendor_msrc·2026-02-10·CVSS 6.5
CVE-2026-21528 [MEDIUM] CWE-1327 Azure IoT Explorer Information Disclosure Vulnerability
Azure IoT Explorer Information Disclosure Vulnerability
Description: Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
FAQ: What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability includes the contents of the user’s local file system, folders or potentially cloud access credentials associated with the system.
FAQ: According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L), and integrity (I:L) but lead to no loss of availability (A:N). What is the impact of this vulnerability?
An attacker who successfully exploited the vulnerab
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-01-22
Published