CVE-2026-6016 Tenda AC9 POST Request WizardHandle decodePwd stack-based overflow

A vulnerability was found in Tenda AC9 15.03.02.13. The affected element is the function decodePwd of the file /goform/WizardHandle of the component POST Request Handler. Performing a manipulation of the argument WANS results in stack-based buffer overflow. The attack can be initiated remotely. T...

CVE-2026-6016

CVE-2026-6016 affects Tenda AC9 15.03.02.13. The vulnerability exists in the decodePwd function of /goform/WizardHandle within the POST Request Handler. Adversaries can trigger a stack-based buffer overflow by manipulating the WANS argument, with the attackable surface exposed remotely. Public ex...

CVE-2026-6016

A vulnerability was found in Tenda AC9 15.03.02.13. The affected element is the function decodePwd of the file /goform/WizardHandle of the component POST Request Handler. Performing a manipulation of the argument WANS results in stack-based buffer overflow. The attack can be initiated remotely. T...

CVE-2026-5500

creationtimestamp| type| source ---|---|--- 2026-04-10 04:52:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4jnkm33m24 2026-04-10 05:15:56+00:00| published-proof-of-concept| Telegram/1WdkdhXUJmGV7ePrqgJjIpgxUFBJfkFq-ncP6HWfcjVt70...

CVE-2026-5501

creationtimestamp| type| source ---|---|--- 2026-04-10 04:47:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4jem5j6g2n 2026-04-10 05:15:56+00:00| published-proof-of-concept| Telegram/1WdkdhXUJmGV7ePrqgJjIpgxUFBJfkFq-ncP6HWfcjVt70 2026-06-23 08:23:37+00:00| seen|...

CVE-2026-6015

This CVE concerns the Tenda AC9 device (firmware version 15.03.02.13). The vulnerability affects the function formQuickIndex in the file /goform/QuickIndex of the POST Request Handler. The issue arises from manipulation of the PPPOEPassword argument, causing a stack-based buffer overflow. An atta...

CVE-2026-6015 Tenda AC9 POST Request QuickIndex formQuickIndex stack-based overflow

A vulnerability has been found in Tenda AC9 15.03.02.13. Impacted is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. Such manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to launch the attack remotely...

CVE-2026-6015 Tenda AC9 POST Request QuickIndex formQuickIndex stack-based overflow

A vulnerability has been found in Tenda AC9 15.03.02.13. Impacted is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. Such manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to launch the attack remotely...

CVE-2026-6014 D-Link DIR-513 POST Request formAdvanceSetup buffer overflow

A flaw has been found in D-Link DIR-513 1.10. This issue affects the function formAdvanceSetup of the file /goform/formAdvanceSetup of the component POST Request Handler. This manipulation of the argument webpage causes buffer overflow. It is possible to initiate the attack remotely. The exploit...

CVE-2026-6014 D-Link DIR-513 POST Request formAdvanceSetup buffer overflow

A flaw has been found in D-Link DIR-513 1.10. This issue affects the function formAdvanceSetup of the file /goform/formAdvanceSetup of the component POST Request Handler. This manipulation of the argument webpage causes buffer overflow. It is possible to initiate the attack remotely. The exploit...

CVE-2026-6013

The CVE-2026-6013 entry describes a buffer overflow in D-Link DIR-513 v1.10 affecting the POST Request Handler’s formSetRoute (/goform/formSetRoute). The vulnerable function mishandles the curTime argument, enabling a remote attacker to trigger a buffer overflow. Exploitation is described as publ...

CVE-2026-6013 D-Link DIR-513 POST Request formSetRoute buffer overflow

A vulnerability was detected in D-Link DIR-513 1.10. This vulnerability affects the function formSetRoute of the file /goform/formSetRoute of the component POST Request Handler. The manipulation of the argument curTime results in buffer overflow. The attack may be performed from remote. The explo...

CVE-2026-2305 AddFunc Head & Footer Code <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields

The AddFunc Head & Footer Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aFhfcheadcode, aFhfcbodycode, and aFhfcfootercode post meta values in all versions up to, and including, 2.3. This is due to the plugin outputting these meta values without any sanitization or...

CVE-2026-5997

creationtimestamp| type| source ---|---|--- 2026-04-10 02:40:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4cbcgyht2i 2026-04-10 03:00:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mj4dez4x6f2q 2026-04-10 03:00:32+00:00| seen|...

CVE-2026-4977

creationtimestamp| type| source ---|---|--- 2026-04-10 02:26:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4bhpid6y24 2026-04-19 16:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjueyd5pfe2c...

CVE-2026-5998

creationtimestamp| type| source ---|---|--- 2026-04-10 02:22:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4bayjzu52j...

CVE-2026-2712

creationtimestamp| type| source ---|---|--- 2026-04-10 02:13:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4aqqaerl25 2026-04-19 05:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjta45iojm2h...

CVE-2026-5806

A security vulnerability has been detected in code-projects Easy Blog Site 1.0. This affects an unknown function of the file /posts/update.php. The manipulation of the argument postTitle leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly a...

CVE-2026-5988

creationtimestamp| type| source ---|---|--- 2026-04-10 01:10:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj45acmzd22o 2026-04-10 01:19:02+00:00| seen| Telegram/r2aLRB54IhOSR-P7tVQ1PquPIQ5c0jGeGUejuuUUcNPCN8 2026-04-30 01:07:07+00:00| seen|...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the error handling path of the TLSXKeyShareProcessPqcHybridClient process. An attacker can cause memory corruption or potentially execute arbitrary code by triggering an error during post-quantum cryptography hybrid...