CVE-2026-75126

PLANET GS-4210-16P2S V3 Stack Buffer Overflow via dispatcher.cgi Standard Handlers

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy attacker-controlled POST parameters into fixed-size stack buffers without length validation: web_vlan_membership_edit_dialog_post; web_dai_vlan_post; web_poe_alive_rmtip_post; web_sys_sntp_post; web_tool_upgradeManager_post; web_port_countersClr_post; web_rmon_statisticsClr_post; web_cablediag_copper_post; web_aaa_*Authlist* handlers; web_acl_mgmt_Rules_Apply_post; web_acl_mgmt_Rules_Edit_post; web_acl_*AceDel_post handlers; web_acl_*AceAdd/Edit_post handlers; web_acl_bindAdd_post; web_acl_bindEdit_post; web_snmp_v3view_add_post; web_snmp_v3group_add_post; web_snmp_v3community_add_post; web_snmp_v3host_add_post; web_snmp_notifyv3_add_post; web_snmp_v3user_add_post; web_snmpv3_remote_engineId_add_post; web_stp_globalSetting_post; web_isg_db_post; web_tacplus*_post handlers; web_dhcp_option82_post; and web_dhcp_port_option82_cid_post. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, resulting in denial of service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Planet Technology Corp

Products

Planet Gs-4210-16p2s

CVE-2025-71407

rubygem-nokogiri: Nokogiri before 1.18.3 Stack Buffer Overflow and Use-After-Free

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed

Vendors

Nokogiri

Products

Nokogiri

CVE-2026-49420

Buffer overflow in libalias RTSP handler

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a stack buffer, potentially achieving remote code execution in the kernel (when using ipfw(4) NAT) or in the natd(8) process (which generally runs as the root user).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Freebsd

Products

Freebsd

CVE-2026-82616

TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

Nr1800x Nr1800x Firmware

CVE-2026-82593

D-Link DIR-825M LTE Module Firmware Upgrade formLtefotaUpgradeFibocom sub_41802C stack-based overflow

A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /boafrm/formLtefotaUpgradeFibocom of the component LTE Module Firmware Upgrade. This manipulation of the argument fota_url causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

D-link

Products

Dir-825m

CVE-2026-75118

http_gdpr_decrypt Pre-Authentication Stack-Based Buffer Overflow

A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface can trigger memory corruption and potentially achieve arbitrary code execution. Successful exploitation can overwrite saved control-flow data on the httpd process stack prior to authentication, resulting in a service crash or potential arbitrary code execution in the context of the affected process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Tl-mr100 V3.20

CVE-2026-19695

Stack-based Buffer Overflow in Wireshark

Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-24911

Kernel Stack Buffer Overflow Causing Denial of Service in Intel PROSet Wireless WiFi Software

Stack-based buffer overflow for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (high) impacts.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Intel

Products

Intel Proset Wireless Wifi Software For Windows Killer Wi-fi 6 Ax1650i\/s Killer Wi-fi 6e Ax1675i\/s and 16 more

CVE-2026-82478

NASA Trick TCP Socket JSONVariableServerThread.cpp parse_request stack-based overflow

A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableServerThread::parse_request of the file trick_source/sim_services/JSONVariableServer/JSONVariableServerThread.cpp of the component TCP Socket Handler. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nasa

Products

Trick

CVE-2026-75421

Stack Buffer Underflow in aria2 IOFile::getLine()

aria2 <=1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine() function.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-58082

Stack based buffer overflow in iconv(3)

The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Some ISO-2022 variants can require up to 10 bytes per character, in which case conversions can trigger a stack buffer overflow of up to four bytes. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Freebsd

Products

Freebsd

CVE-2026-82592

D-Link DIR-825M Disk Formatting Handler Endpoint formDiskFormat sub_46725C stack-based overflow

A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the file /boafrm/formDiskFormat of the component Disk Formatting Handler Endpoint. The manipulation of the argument partition results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

D-link

Products

Dir-825m

CVE-2026-0826

Poly Voice – Possible Remote Control of Certain Poly Devices

In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.

CVSS 4.0 · 9.2 Critical EPSS 32.2% KEV · Not listed

Vendors

Hp Inc.

Products

Poly Trio 8300 Poly Trio 8500 Poly Trio 8800 and 1 more

CVE-2026-14679

PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory

Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-75368

Stack Overflow in SpaceDot AcubeSAT OBC Causes DoS via ECSS TC Message

A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service (DoS) via supplying a crafted ECSS TC message.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-21807

HCL BigFix Quantum Risk Analyzer is affected by a stack-based buffer overflow

HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buffer overflow.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Hclsoftware

Products

Bigfix Quantum Risk Analyzer

CVE-2026-68863

Stack-based Buffer Overflow in Dell PowerProtect One Leading to Denial of Service

Dell PowerProtect One, versions 20.1.0.0 and below, contain a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Powerprotect One

CVE-2026-13086

Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint

A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-19318

Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-78010

Fireware OS Stack-Based Buffer Overflow in iked Allows Unauthenticated Denial of Service

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os