CVE Database

CVE-2026-2202 High · 8.8 CWE-120 Feb 9, 2026

Tenda AC8 httpd WifiGuestSet fromSetWifiGusetBasic buffer overflow

A vulnerability was detected in Tenda AC8 16.03.33.05. Affected is the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet of the component httpd. The manipulation of the argument shareSpeed results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

CVE-2026-2137 High · 8.8 CWE-120 Feb 8, 2026

Tenda TX3 SetIpMacBind buffer overflow

A vulnerability has been found in Tenda TX3 up to 16.03.13.11_multi. This impacts an unknown function of the file /goform/SetIpMacBind. The manipulation of the argument list leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2020-37171 Medium · 5.5 CWE-120 Feb 6, 2026

TapinRadio 2.12.3 - 'username' Denial of Service

TapinRadio 2.12.3 contains a denial of service vulnerability in the application proxy username configuration that allows local attackers to crash the application. Attackers can overwrite the username field with 10,000 bytes of arbitrary data to trigger an application crash and prevent normal program functionality.

CVE-2020-37170 Medium · 5.5 CWE-120 Feb 6, 2026

TapinRadio 2.12.3 - 'address' Denial of Service

TapinRadio 2.12.3 contains a denial of service vulnerability in the application proxy address configuration that allows local attackers to crash the application. Attackers can overwrite the address field with 3000 bytes of arbitrary data to trigger an application crash and prevent normal program functionality.

CVE-2020-37166 Medium · 5.5 CWE-120 Feb 6, 2026

AbsoluteTelnet 11.12 - 'SSH2/username' Denial of Service

AbsoluteTelnet 11.12 contains a denial of service vulnerability in the SSH2 username input field that allows local attackers to crash the application. Attackers can overwrite the username field with a 1000-byte buffer, causing the application to become unresponsive and terminate.

CVE-2020-37165 Medium · 5.5 CWE-120 Feb 6, 2026

AbsoluteTelnet 11.12 - "license name" Denial of Service

AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name. Attackers can generate a 2500-character payload and paste it into the license name field to trigger an application crash.

CVE-2020-37164 Medium · 5.5 CWE-120 Feb 6, 2026

AbsoluteTelnet 11.12 - "license entry" Denial of Service

AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name. Attackers can generate a 2500-character payload and paste it into the license entry field to trigger an application crash.

CVE-2020-37155 High · 7.5 CWE-120 Feb 6, 2026

Core FTP Lite 1.3 - Denial of Service (PoC)

Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that allows attackers to crash the application by supplying oversized input. Attackers can generate a 7000-byte payload of repeated 'A' characters to trigger an application crash without requiring additional interaction.

CVE-2020-37109 High · 7.5 CWE-120 Feb 6, 2026

aSc TimeTables 2020.11.4 - Denial of Service

aSc TimeTables 2020.11.4 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the Subject title field with a large buffer. Attackers can generate a 1000-character buffer and paste it into the Subject title to trigger an application crash and potential instability.

CVE-2020-37107 High · 7.5 CWE-120 Feb 6, 2026

Core FTP LE 2.2 - Denial of Service

Core FTP LE 2.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the account field with a large buffer. Attackers can create a text file with 20,000 repeated characters and paste it into the account field to cause the application to become unresponsive and require reinstallation.

CVE-2026-24922 Medium · 5.5 CWE-120 Feb 6, 2026

Classic Buffer Overflow in Huawei Harmonyos

Buffer overflow vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2020-37131 Medium · 5.5 CWE-120 Feb 5, 2026

Product Key Explorer 4.2.2.0 - 'Key' Denial of Service

Nsauditor Product Key Explorer 4.2.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by inputting a specially crafted registration key. Attackers can generate a payload of 1000 bytes of repeated characters and paste it into the 'Key' input field to trigger the application crash.

CVE-2020-37130 High · 7.5 CWE-120 Feb 5, 2026

Nsauditor 3.2.0.0 - 'Name' Denial of Service

Nsauditor 3.2.0.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can create a malicious payload of 1000 bytes of repeated characters to trigger an application crash when pasted into the registration name field.

CVE-2020-37075 Critical · 9.8 CWE-120 Feb 3, 2026

LanSend Buffer Overflow in Add Computers Wizard File Import

LanSend 3.2 contains a buffer overflow vulnerability in the Add Computers Wizard file import functionality that allows remote attackers to execute arbitrary code. Attackers can craft a malicious payload file to trigger a structured exception handler (SEH) overwrite and execute shellcode when importing computers from a file.

CVE-2020-37074 Critical · 9.8 CWE-120 Feb 3, 2026

Remote Desktop Audit Buffer Overflow in Add Computers Wizard (SEH Bypass)

Remote Desktop Audit 2.3.0.157 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code during the Add Computers Wizard file import process. Attackers can craft a malicious payload file to trigger a structured exception handler (SEH) bypass and execute shellcode when importing computer lists.

CVE-2020-37070 Critical · 9.8 CWE-120 Feb 3, 2026

CloudMe 1.11.2 Buffer Overflow Leading to Remote Code Execution

CloudMe 1.11.2 contains a buffer overflow vulnerability that allows remote attackers to execute arbitrary code through crafted network packets. Attackers can exploit the vulnerability by sending a specially crafted payload to the CloudMe service running on port 8888, enabling remote code execution.

CVE-2020-37069 Critical · 9.8 CWE-120 Feb 3, 2026

Konica Minolta FTP Utility: NLST Command Buffer Overflow (CVE-2020-37069)

Konica Minolta FTP Utility 1.0 contains a buffer overflow vulnerability in the NLST command that allows attackers to overwrite system registers. Attackers can send an oversized buffer of 1500 'A' characters to crash the FTP server and potentially execute unauthorized code.

CVE-2020-37068 Critical · 9.8 CWE-120 Feb 3, 2026

Konica Minolta FTP Utility LIST Command Buffer Overflow

Konica Minolta FTP Utility 1.0 contains a buffer overflow vulnerability in the LIST command that allows attackers to overwrite system registers. Attackers can send an oversized buffer of 1500 'A' characters to crash the FTP server and potentially execute unauthorized code.

CVE-2020-37065 Critical · 9.8 CWE-120 Feb 3, 2026

StreamRipper32 2.6 Buffer Overflow via SongPattern Input

StreamRipper32 version 2.6 contains a buffer overflow vulnerability in the Station/Song Section that allows attackers to overwrite memory by manipulating the SongPattern input. Attackers can craft a malicious payload exceeding 256 bytes to potentially execute arbitrary code and compromise the application.

CVE-2025-67189 Medium · 6.5 CWE-120 Feb 3, 2026

Classic Buffer Overflow in Totolink A950rg Firmware

A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK A950RG V4.1.2cu.5204_B20210112. The urlKeyword parameter is not properly validated, and the function concatenates multiple user-controlled fields into a fixed-size stack buffer without performing boundary checks. A remote attacker can exploit this flaw to cause denial of service or potentially achieve arbitrary code execution.

CVE-2025-67188 Critical · 9.8 CWE-120 Feb 3, 2026

TOTOLINK A950RG Stack Buffer Overflow in setRadvdCfg (CVE-2025-67188)

A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The issue resides in the setRadvdCfg interface of the /lib/cste_modules/ipv6.so module. The function fails to properly validate the length of the user-controlled radvdinterfacename parameter, allowing remote attackers to trigger a stack buffer overflow.

CVE-2025-67186 Critical · 9.8 CWE-120 Feb 3, 2026

TOTOLINK A950RG Buffer Overflow in setUrlFilterRules (CVE-2025-67186)

TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules interface of /lib/cste_modules/firewall.so. The vulnerability occurs because the `url` parameter is not properly validated for length, allowing remote attackers to trigger a buffer overflow, potentially leading to arbitrary code execution or denial of service.

CVE-2025-47399 High · 7.8 CWE-120 Feb 2, 2026

Buffer Copy Without Checking Size of Input in Camera

Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters.

CVE-2020-37050 Critical · 9.8 CWE-120 Jan 30, 2026

Quick Player Buffer Overflow via Malicious .m3l File

Quick Player 1.3 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting a malicious .m3l file with carefully constructed payload. Attackers can trigger the vulnerability by loading a specially crafted file through the application's file loading mechanism, potentially enabling remote code execution.

CVE-2020-37049 High · 8.4 CWE-120 Jan 30, 2026

Frigate 3.36.0.9 - 'Command Line' Local Buffer Overflow

Frigate 3.36.0.9 contains a local buffer overflow vulnerability in the Command Line input field that allows attackers to execute arbitrary code. Attackers can craft a malicious payload to overflow the buffer, bypass DEP, and execute commands like launching calc.exe through a specially crafted input sequence.