CVE-2026-19791

HighCVSS 8.8/10Last modified Aug 14, 2026

Description

A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addStaticRoute of the file /goform/module of the component httpd web management interface. Executing a manipulation of the argument staticRouteNet can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119CWE-121

Affected software

No affected versions have been published.

Timeline

Published
Aug 14, 2026
Last modified
Aug 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-197928.8A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the coCVE-2026-197947.2The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficienCVE-2026-197956.2Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A maliciousCVE-2026-197967.2The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting vCVE-2026-197976.1The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all veCVE-2026-197984.3The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_statusCVE-2026-19805.3The WPBookit plugin for WordPress is vulnerable to unauthorized data disclosure due to a missing authorization check on the 'get_customer_liCVE-2026-198004.9The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via tCVE-2026-198014.3The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorizationCVE-2026-198024.3The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and incCVE-2026-198048.8The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vuCVE-2026-198068.8The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentic
CVE-2026-19791: High severity, CVSS 8.8 | Vulnix