Skip to content
Multiple Critical Vulnerabilities Disclosed for FearlessCMS and D-Link Devices

Multiple Critical Vulnerabilities Disclosed for FearlessCMS and D-Link Devices

First seen 29 Oct 2026, 01:07 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 02:12 UTC
  • •CVE-2026-63190 in FearlessCMS allows unauthenticated admin bypass and arbitrary file writes.
  • •CVE-2026-118579 in D-Link DIR-505 enables remote backdoor creation via CGI manipulation.
  • •Both vulnerabilities have a CVSS score above 9.0, marking them as critical.

On October 28, 2026, two critical vulnerabilities were disclosed: CVE-2026-63190 affecting FearlessCMS and CVE-2026-118579 impacting D-Link DIR-505 devices. FearlessCMS versions prior to 0.1.4 are vulnerable to an unauthenticated admin URI bypass, allowing arbitrary file writes and data exposure. This flaw is due to a design issue in the `router.php` file, enabling full system compromise. Meanwhile, the D-Link DIR-505 vulnerability allows remote manipulation of arguments in the Web Management CGI, creating a backdoor for unauthorized access. Both vulnerabilities have a CVSS score above 9.0, categorizing them as critical. No public proof-of-concept exploits have been reported for either vulnerability, and both are currently listed as having no known exploitation. Security advisories are under review for mitigation strategies.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-28
CVE-2026-63190 published
FearlessCMS vulnerability disclosed, allowing unauthenticated access to admin functions.
TheHackerWire
2026-10-28
CVE-2026-118579 published
D-Link DIR-505 vulnerability disclosed, enabling remote backdoor creation through CGI arguments.
TheHackerWire
2026-10-28
CVE-2026-117574 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-28
CVE-2026-118477 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-28
CVE-2026-111411 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-28
CVE-2026-44179 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (3)

Following this threat?

Track CVE-2026-111411 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (20)

1 / 4

Common questions

Which versions of FearlessCMS are affected?
FearlessCMS versions prior to 0.1.4 are vulnerable to CVE-2026-63190.
What is the impact of the D-Link vulnerability?
CVE-2026-118579 allows remote attackers to create a backdoor for unauthorized access.
Are there any known exploits for these vulnerabilities?
No public proof-of-concept exploits have been reported for either CVE at this time.