CVE-2026-1951

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Delta Electronics AS320T has no checking of the length of the buffer with the directory name

vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published
Apr 24, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-195138.1The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to inCVE-2026-195157.0The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projectCVE-2026-195169.1A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request toolCVE-2026-195176.5Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open SoCVE-2026-195186.5Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation.CVE-2026-195194.3A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to pCVE-2026-19527.5Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability.CVE-2026-19538.2Nukegraphic CMS v3.1.2 contains a stored cross-site scripting (XSS) vulnerability in the user profile edit functionality at /ngc-cms/user-edCVE-2026-195325.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path TraversaCVE-2026-195347.5undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the CVE-2026-195358.6Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface of AdvanCVE-2026-195387.5The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when conne
CVE-2026-1951: Critical severity, CVSS 9.8 | Vulnix