CVE-2026-6094

A vulnerability was found in Tenda AC19 version 16.03.10.07 in the saveParentControlInfo function of the /goform/saveParentControlInfo file. Manipulating the deviceId argument causes a heap-based buffer overflow. The attack can be carried out remotely, and the exploit has been publicly disclosed.

A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during setup. An authenticated attacker with client management permissions can bypass security controls and upload a malicious JavaScript policy that executes on the server.

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress up to and including 3.8.0 is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function. The handler is registered for both wp_ajax and wp_ajax_nopriv and gated solely by the 'file_handling_nonce' nonce, which is exposed in the public checkout page markup.

The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in FormHandler::validate_checkout_fields() in versions up to and including 1.1.4. The checkout registration path stores the raw $_POST['user_roles'] value without validation, and add_user_data() injects it as the new account's role.

The LatePoint plugin for WordPress is vulnerable to authentication bypass via account takeover in versions up to and including 5.7.6. OsModel::build_conditions_query() compares WHERE-clause values against literal strings 'IS NULL' and 'IS NOT NULL' and concatenates a match directly into SQL without binding, allowing unauthenticated attackers to send params[password_reset_token]=IS NOT NULL to the public customer_cabinet__change_password AJAX route and overwrite the lowest-id customer's password.

The Naimur Email OTP Verification for WooCommerce plugin is vulnerable to authentication bypass in versions up to and including 2.1.0. The password-reset finalization endpoint authorizes the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, session binding, or per-reset token, and the scheduled cleanup cron has no handler so it never runs.

A vulnerability was detected in TOTOLINK CA300-PoE version 6.2c.884 affecting the setWiFiBasicConfig function in /cgi-bin/cstecgi.cgi. Manipulation of the KeyStr argument leads to a buffer overflow. The attack can be initiated remotely and a public exploit is available.

In TOTOLINK CA300-PoE version 6.2c.884, the setWanConfig function in /cgi-bin/cstecgi.cgi improperly handles the pppoeUser/priDns/secDns arguments, leading to a buffer overflow. The vulnerability can be exploited remotely, and a public exploit is already available.

In TOTOLINK CA300-PoE version 6.2c.884, the setLanguageCfg function in /cgi-bin/cstecgi.cgi improperly processes the langType argument, resulting in a buffer overflow. The attack can be initiated remotely, and the exploit has been publicly released.

In TOTOLINK CA300-PoE version 6.2c.884, the setLanConfig function in /cgi-bin/cstecgi.cgi mishandles the lanDns/lanSecDns/langType arguments, leading to a buffer overflow. The vulnerability can be exploited remotely, and a public exploit is already available.