PULSE
ES
FEED
ransomn0n reclama a Prafesta Ind. e Com. de Embalagens Ltda · BR · Manufacturingransomplay reclama a WSBI-ESBG · BE · Financial Servicesransomplay reclama a New Tec Tool Limited · HK · Manufacturingransomplay reclama a MicroSearch Corporation · Technologyransomplay reclama a Pure Options · Financial Servicesransomredact reclama a ONEOK, Inc. · US · Energy & Utilitiesransomvexy ransomware reclama a Data-Core Systems · Technologyransomwallstreet reclama a Girl Scouts of Eastern Massachusetts · US · Educationransomn0n reclama a Company #80 · Not Foundransomn0n reclama a Company #79 · US · Not Foundransomn0n reclama a Company #78 · Not Foundransomn0n reclama a Company #77 · US · Not Foundransomn0n reclama a Company #76 · US · Not Foundransomn0n reclama a Company #72 · Not Foundransomn0n reclama a Prafesta Ind. e Com. de Embalagens Ltda · BR · Manufacturingransomplay reclama a WSBI-ESBG · BE · Financial Servicesransomplay reclama a New Tec Tool Limited · HK · Manufacturingransomplay reclama a MicroSearch Corporation · Technologyransomplay reclama a Pure Options · Financial Servicesransomredact reclama a ONEOK, Inc. · US · Energy & Utilitiesransomvexy ransomware reclama a Data-Core Systems · Technologyransomwallstreet reclama a Girl Scouts of Eastern Massachusetts · US · Educationransomn0n reclama a Company #80 · Not Foundransomn0n reclama a Company #79 · US · Not Foundransomn0n reclama a Company #78 · Not Foundransomn0n reclama a Company #77 · US · Not Foundransomn0n reclama a Company #76 · US · Not Foundransomn0n reclama a Company #72 · Not Found
← All CVEs
CVE WatchOct 16, 2026

CVE-2026-111711

Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, wh

CVSS

9.8

Critical

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Oct 16, 2026 · Last modified: Oct 16, 2026 · CWE-121

EPSS · 30d

Not enough EPSS history yet.

Technical description

Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1026939.6 CRI
—
——0RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.7hCVE-2026-1084458.8 HIG
36.9%
——11Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.8hCVE-2026-1084408.8 HIG
36.9%
——11Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.8hCVE-2026-1084318.8 HIG
37.7%
——11Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.8hCVE-2026-798407.3 HIG
0.6%
——0A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.1dCVE-2026-798397.3 HIG
0.6%
——0A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.1d