CVE-2026-24114

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate `pPortMapIndex` may lead to buffer overflows when using `strcpy`.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published
Mar 2, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-241159.8An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the sizes of `gstup` and `gstdwn` before concatenating them intCVE-2026-241165.5Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with CVE-2026-241175.3Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services beCVE-2026-241189.8vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackCVE-2026-24126.5The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up CVE-2026-241209.8vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented alCVE-2026-241223.7Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validiCVE-2026-241236.5BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML'CVE-2026-241249.8Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoinCVE-2026-241256.3Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relCVE-2026-241269.1Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSHCVE-2026-241276.1Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists
CVE-2026-24114: Critical severity, CVSS 9.8 | Vulnix