CVE-2026-15340

CriticalCVSS 9.8/10Last modified Oct 11, 2026

Description

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 9, 2026
Last modified
Oct 11, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-153419.8The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to,CVE-2026-153426.5Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, dCVE-2026-153438.6A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the DependaCVE-2026-153444.9The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and incCVE-2026-153454.3The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versiCVE-2026-153466.1The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parametCVE-2026-153486.3The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, andCVE-2026-153494.3The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versionCVE-2026-15359.8A security vulnerability has been detected in code-projects Online Music Site 1.0. This impacts an unknown function of the file /AdministratCVE-2026-153504.3The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.20. This is due toCVE-2026-153514.9The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL InjectiCVE-2026-153527.5A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The flaw allows the application to crash
CVE-2026-15340: Critical severity, CVSS 9.8 | Vulnix