CVE-2026-5204

HighCVSS 8.8/10Last modified Jul 24, 2026

Description

A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component Parameter Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-52056.3A vulnerability was identified in chatwoot up to 4.11.2. Affected by this vulnerability is the function Webhooks::Trigger in the library lib CVE-2026-52066.3A security vulnerability has been detected in code-projects Simple Gym Management System 1.0. This vulnerability affects unknown code of the CVE-2026-52076.5The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1. Thi CVE-2026-52087.2Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via inje CVE-2026-52092.4A security vulnerability has been detected in SourceCodester Leave Application System 1.0. Affected by this issue is some unknown functional CVE-2026-520976.8An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), O CVE-2026-520989.8An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint CVE-2026-52107.3A vulnerability was detected in SourceCodester Leave Application System 1.0. This affects an unknown part. Performing a manipulation of the CVE-2026-521007.5Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary cod CVE-2026-521019.1An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadR CVE-2026-521029.8An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary comma CVE-2026-521039.8A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attacke