CVE-2026-35499

CriticalCVSS 9.1/10Last modified Oct 23, 2026

Description

An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-35505.3The RockPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.17. This is due to missi CVE-2026-355013.7When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor CVE-2026-355025.3Deserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0 within Ring 3: User Applications may allow an CVE-2026-355039.8A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be performed entirely on the client side, relyi CVE-2026-355045.5PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when using SMTPS communication.CVE-2026-355057.5An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory CVE-2026-355068.6ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processin CVE-2026-355076.5Shynet before 0.14.0 allows Host header injection in the password reset flow.CVE-2026-355086.1Shynet before 0.14.0 allows XSS in urldisplay and iconify template filters,CVE-2026-35514.4The Custom New User Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's admin settings in all ve CVE-2026-355128.8xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX (graphics dynamic virtual channel) CVE-2026-355146.5Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.