CVE-2026-11736

MediumCVSS 4.9/10Last modified Sep 9, 2026

Description

A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Sep 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-117374.5Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local networ CVE-2026-117384.4Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network CVE-2026-117396.4A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to inte CVE-2026-11747.5A vulnerability was determined in birkir prime up to 0.4.0.beta.0. This affects an unknown function of the file /graphql of the component Gr CVE-2026-117423.6The kernel queue helper z_queue_node_peek() in kernel/queue.c dereferences a node taken from a queue's data_q list, reading the node's flag CVE-2026-117436.6The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length on its read and write CVE-2026-117443.8An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sani CVE-2026-117458.8A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not ver CVE-2026-117469.4A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting re CVE-2026-117476.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Seres Software syWEB allows Reflected CVE-2026-117486.9A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm su CVE-2026-11757.5A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql of the component Gr