CVE-2026-91843

CriticalCVSS 9.8/10Last modified Sep 18, 2026

Description

A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 16, 2026
Last modified
Sep 18, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-918447.3Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows UsCVE-2026-918467.1Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user isCVE-2026-918474.8The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-asCVE-2026-918487.3A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.phpCVE-2026-918496.3A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=uCVE-2026-91857.5The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and includCVE-2026-918515.3Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. DashboardsController::CVE-2026-918526.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affectCVE-2026-918537.4A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bCVE-2026-918544.3A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the file main/reg.php. SuchCVE-2026-918555.3A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality of the file lib/pfcp/CVE-2026-918575.3Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are:
CVE-2026-91843: Critical severity, CVSS 9.8 | Vulnix