https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T06:51:47.557902+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-333035 EUVD-2026-333035 2026-10-15T06:51:47.560037+00:00 EUVD-2026-333035 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35716 fkie_cve-2026-35716 2026-10-15T06:51:47.560068+00:00

A stack-based buffer overflow in the motion_privacy.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via an oversized n1 parameter in a POST request to the /cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, or /cgi-bin/admin/setmd_profile.cgi endpoint (all symlinks to the same binary). The parameter value is copied into a fixed-size 0xa4-byte stack buffer without bounds checking, overwriting the saved link register. The binary is compiled without stack canaries.

 https://cve.radiocsirt.org/vuln/ghsa-pj36-9w4r-h2r4 GHSA-pj36-9w4r-h2r4 2026-10-15T06:51:47.560101+00:00

A stack-based buffer overflow in the motion_privacy.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via an oversized n1 parameter in a POST request to the /cgi-bin/admin/setpm.cgi, /cgi-bin/admin/setmd.cgi, or /cgi-bin/admin/setmd_profile.cgi endpoint (all symlinks to the same binary). The parameter value is copied into a fixed-size 0xa4-byte stack buffer without bounds checking, overwriting the saved link register. The binary is compiled without stack canaries.