CVE-2026-5979

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in D-Link DIR-605L 2.13B01. Affected by this vulnerability is the function formVirtualServ of the file /goform/formVirtualServ of the component POST Request Handler. The manipulation of the argument curTime results in buffer overflow. The attack can be launched remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-597913.5In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible CVE-2026-597929.8In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible CVE-2026-597938.8In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration CVE-2026-597945.4In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data CVE-2026-597956.1In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible CVE-2026-597968.1In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks CVE-2026-597979.8Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affec CVE-2026-597998.8Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authen CVE-2026-59808.8A flaw has been found in D-Link DIR-605L 2.13B01. Affected by this issue is the function formSetMACFilter of the file /goform/formSetMACFilt CVE-2026-598009.89Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (thi CVE-2026-598019.89Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider manag CVE-2026-598028.2PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attacker