CVE-2026-90607
A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSche
CVSS
9.9
Crítico
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 14 sept 2026 · Última mod.: 14 sept 2026 · CWE-119 · CWE-120
Sin historial EPSS suficiente todavía.
A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The manipulation of the argument submit-url results in buffer overflow. The attack may be performed from remote. The exploit is now public and may be used.
- github.comhttps://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/bof-formNewSchedule.md
- vuldb.comhttps://vuldb.com/cve/CVE-2026-90607
- vuldb.comhttps://vuldb.com/submit/914015
- vuldb.comhttps://vuldb.com/vuln/403189
- vuldb.comhttps://vuldb.com/vuln/403189/cti
- www.totolink.nethttps://www.totolink.net/
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-906876.3 MED—
———A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is able to resolve this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.2hCVE-2026-906865.3 MED—
———A vulnerability was found in GPAC up to f1219cde. This affects the function gf_bt_report of the file scene_manager/loader_bt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version abi-16.23 is able to mitigate this issue. The patch is identified as afca1f1181668d85941d51ed1adf647807d5d975. It is suggested to upgrade the affected component.2hCVE-2026-16726——
———Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows
attackers to stop Windows.2hCVE-2026-906825.3 MED—
———A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAG_GPS_LAT/TAG_GPS_LONG leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.3hCVE-2026-906813.3 BAJ—
———A weakness has been identified in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This manipulation causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.3hCVE-2023-242912.9 BAJ—
———Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the record length parameter.3h