CVE-2026-5841

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A weakness has been identified in Tenda i3 1.0.0.6(2204). The affected element is the function R7WebsSecurityHandler of the component HTTP Handler. Executing a manipulation can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Apr 9, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-584107.1ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authorization flaw in the family-scoped endpointsCVE-2026-584117.0ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities were identified dueCVE-2026-584136.1Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes tCVE-2026-584145.5Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects filCVE-2026-584155.3Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platCVE-2026-584167.1Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)CVE-2026-584177.5REST API exposes organization membership of private organizations to publicCVE-2026-584186.5SSRF via HTTP Redirect in Repository MigrationCVE-2026-584197.5Notification API leaks private issue metadata after access revocationCVE-2026-58427.3A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of CVE-2026-584204.4Local File Inclusion via file:// URI in Migration RestoreCVE-2026-584217.5Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service