CVE-2026-90689
A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. Impacted is the function formDelWebAuthWhiteUser. Performin
CVSS
8.8
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Sep 14, 2026 · Last modified: Sep 14, 2026 · CWE-119 · CWE-121
Not enough EPSS history yet.
A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation of the argument webAuthWhiteUserIndex results in stack-based buffer overflow. The attack can be initiated remotely.
- github.comhttps://github.com/Amalll-Sec/router-vulnerability-research/blob/main/advisories/Tenda/W20E/formDelWebAuthWhiteUser/README.md
- vuldb.comhttps://vuldb.com/cve/CVE-2026-90689
- vuldb.comhttps://vuldb.com/submit/914981
- vuldb.comhttps://vuldb.com/vuln/403222
- vuldb.comhttps://vuldb.com/vuln/403222/cti
- www.tenda.com.cnhttps://www.tenda.com.cn/
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-907078.3 HIG—
——0A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf_nnrf_try_old_amf_discovery_fallback of the file src/amf/nnrf-handler.c of the component Old AMF Discovery Fallback. The manipulation of the argument discovery_option results in use after free. The attack may be performed from remote. The patch is identified as ddd683a35f8aaac2b7b9884a24cd53bddfc65238. Applying a patch is advised to resolve this issue.3hCVE-2026-906985.3 MED—
——0A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.44 is able to resolve this issue. The patch is identified as af05c9302bba508b736c3da1d5670f63fe8b7db4. You should upgrade the affected component.5hCVE-2026-906939.9 CRI—
——0A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible.6hCVE-2026-906929.9 CRI—
——0A vulnerability was detected in D-Link DIR-878 120B05. This affects the function SetDynamicDNSIPv6Settings of the component Dynamic DNS IPv6 Settings. The manipulation of the argument IPv6Address/Hostname results in stack-based buffer overflow. The attack may be launched remotely.7hCVE-2026-906886.5 MED—
——0A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Such manipulation of the argument IPMacBindRule leads to stack-based buffer overflow. It is possible to launch the attack remotely.7hCVE-2026-827854.3 MED—
——0Stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-service (DoS) condition.2h