CVE-2026-1505
published 2026-01-28CVE-2026-1505: A vulnerability was found in D-Link DIR-615 4.10. This issue affects some unknown processing of the file /set_temp_nodes.php of the component URL Filter. The…
PriorityP359high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
4.47%
90.4th percentile
A vulnerability was found in D-Link DIR-615 4.10. This issue affects some unknown processing of the file /set_temp_nodes.php of the component URL Filter. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| d-link | dir-615 | — | — |
| dlink | dir-615_firmware | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.3HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.08.3HIGHAV:N/AC:L/Au:M/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close
ghsa·2026-06-19
CVE-2026-54897 [HIGH] CWE-416 Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close
Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close
### Summary
`Oj::Doc` iterators (`each_value`, `each_child`, `each_leaf`) are vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls `doc.close` or `d.close`, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby.
### Version
- **Software**: oj gem
- **Affected**: all versions with `ext/oj/fast.c`
- **Latest tested**: 3.17.1 (confirmed present)
### Details
The iterators in `ext/oj/fast.c` follow the pattern:
```c
// fast.c:1505 (doc_each_child)
static VALUE doc_each_child(VALUE self, ...) {
...
while (cur != NULL) {
rb_yield(...); // ← Ruby bl
GHSA
GHSA-jhqv-457v-r3vc: A vulnerability was found in D-Link DIR-615 4
ghsa_unreviewed·2026-01-28
CVE-2026-1505 [HIGH] CWE-77 GHSA-jhqv-457v-r3vc: A vulnerability was found in D-Link DIR-615 4
A vulnerability was found in D-Link DIR-615 4.10. This issue affects some unknown processing of the file /set_temp_nodes.php of the component URL Filter. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-01-28
Published