CVE-2026-3380

Tenda F453 L7Im frmL7ImForm buffer overflow

A vulnerability was found in Tenda F453 1.0.0.3. This issue affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page results in buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

F453 F453 Firmware

CVE-2026-3382

ChaiScript boxed_number.hpp get_as memory corruption

A security flaw has been discovered in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::Boxed_Number::get_as of the file include/chaiscript/dispatchkit/boxed_number.hpp. Performing a manipulation results in memory corruption. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Chaiscript

Products

Chaiscript

CVE-2026-3386

wren-lang wren wren_compiler.c emitOp out-of-bounds

A flaw has been found in wren-lang wren up to 0.4.0. Affected by this vulnerability is the function emitOp of the file src/vm/wren_compiler.c. This manipulation causes out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wren Wren-lang

Products

Wren Wren

CVE-2026-3390

FascinatedBox lily Error Reporting lily_build_error.c patch_line_end out-of-bounds

A vulnerability was identified in FascinatedBox lily up to 2.3. This issue affects the function patch_line_end of the file src/lily_build_error.c of the component Error Reporting. The manipulation leads to out-of-bounds read. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Fascinatedbox Lily-lang

Products

Lily Lily

CVE-2026-3391

FascinatedBox lily lily_emitter.c clear_storages out-of-bounds

A security flaw has been discovered in FascinatedBox lily up to 2.3. Impacted is the function clear_storages of the file src/lily_emitter.c. The manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Fascinatedbox Lily-lang

Products

Lily Lily

CVE-2026-3398

Tenda F453 httpd AdvSetWan fromAdvSetWan buffer overflow

A vulnerability was determined in Tenda F453 1.0.0.3. Affected is the function fromAdvSetWan of the file /goform/AdvSetWan of the component httpd. Executing a manipulation of the argument wanmode/PPPOEPassword can lead to buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

F453 F453 Firmware

CVE-2026-2779

Incorrect boundary conditions in the Networking: JAR component

Incorrect boundary conditions in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Firefox Esr Thunderbird

CVE-2026-2778

Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component

Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Firefox Esr Thunderbird

CVE-2026-2776

Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software

Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Firefox Esr Thunderbird

CVE-2026-2773

Incorrect boundary conditions in the Web Audio component

Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Firefox Esr Thunderbird

CVE-2017-7407

curl: --write-out out of bounds read

The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Haxx Redhat

Products

Curl Rhel Software Collections

CVE-2017-1000101

curl: URL globbing out of bounds read

curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.

CVSS 3.1 · 6.5 Medium EPSS 3.7% KEV · Not listed

Vendors

Haxx Redhat

Products

Curl Rhel Software Collections

CVE-2026-6168

TOTOLINK A7000R cstecgi.cgi setWiFiEasyGuestCfg stack-based overflow

A flaw has been found in TOTOLINK A7000R up to 9.1.0u.6115. The affected element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ssid5g causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

A7000r A7000r Firmware

CVE-2026-29086

Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hono

Products

Hono

CVE-2026-28350

lxml_html_clean: <base> tag injection through default Cleaner configuration

lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the <base> tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for <base>, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Fedora-python Fedoralovespython

Products

Lxml Html Clean Lxml Html Clean

CVE-2026-3606

Ettercap etterfilter ef_output.c add_data_segment out-of-bounds

A vulnerability has been found in Ettercap 0.8.4-Garofalo. Affected by this vulnerability is the function add_data_segment of the file src/ettercap/utils/etterfilter/ef_output.c of the component etterfilter. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ettercap Ettercap-project

Products

Ettercap Ettercap

CVE-2026-3663

xlnt-community xlnt XLSX File compound_document.cpp xsgetn out-of-bounds

A vulnerability was found in xlnt-community xlnt up to 1.6.1. This issue affects the function xlnt::detail::compound_document_istreambuf::xsgetn of the file source/detail/cryptography/compound_document.cpp of the component XLSX File Parser. Performing a manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit has been made public and could be used. The patch is named 147. It is recommended to apply a patch to fix this issue.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Xlnt-community

Products

Xlnt

CVE-2026-3664

xlnt-community xlnt Encrypted XLSX File compound_document.cpp read_directory out-of-bounds

A vulnerability was determined in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::compound_document::read_directory of the file source/detail/cryptography/compound_document.cpp of the component Encrypted XLSX File Parser. Executing a manipulation can lead to out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 147. Applying a patch is advised to resolve this issue.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Xlnt-community

Products

Xlnt

CVE-2026-3678

Tenda FH451 AdvSetWan sub_3C434 stack-based overflow

A vulnerability was determined in Tenda FH451 1.0.0.9. Affected is the function sub_3C434 of the file /goform/AdvSetWan. This manipulation of the argument wanmode/PPPOEPassword causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

Fh451 Fh451 Firmware

CVE-2026-3703

Wavlink NU516U1 login.cgi sub_401A10 out-of-bounds write

A flaw has been found in Wavlink NU516U1 251208. This affects the function sub_401A10 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to out-of-bounds write. The attack may be performed from remote. The exploit has been published and may be used. Upgrading the affected component is recommended. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Wavlink

Products

Wl-nu516u1 Wl-nu516u1 Firmware