CVE-2026-8259
published 2026-05-11CVE-2026-8259: A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. The affected element is an unknown function of the file /goform/telnet of the component httpd. The…
PriorityP267high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
8.31%
94.9th percentile
A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. The affected element is an unknown function of the file /goform/telnet of the component httpd. The manipulation of the argument lan.ip leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tenda | ac6 | — | — |
| tenda | ac6 | — | — |
| tenda | ac6_firmware | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv4.02.0LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.05.8MEDIUMAV:N/AC:L/Au:M/C:P/I:P/A:P
ghsa7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization
ghsa·2026-07-11·CVSS 7.5
CVE-2026-49844 [HIGH] CWE-116 Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization
Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.
The defect is reachable only when both of the following conditions hold:
* The application uses the message resolver https://logging.apache.org/log4j/2.x/ma
GHSA
GHSA-59c7-jp82-73fm: A vulnerability has been found in Tenda AC6 2
ghsa_unreviewed·2026-05-11
CVE-2026-8259 [LOW] CWE-77 GHSA-59c7-jp82-73fm: A vulnerability has been found in Tenda AC6 2
A vulnerability has been found in Tenda AC6 2.0/15.03.06.23. The affected element is an unknown function of the file /goform/telnet of the component httpd. The manipulation of the argument lan.ip leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
VulDB
Tenda AC6 2.0/15.03.06.23 httpd /goform/telnet lan.ip os command injection
vuldb·2026-05-10
CVE-2026-8259 [CRITICAL] Tenda AC6 2.0/15.03.06.23 httpd /goform/telnet lan.ip os command injection
A vulnerability marked as critical has been reported in Tenda AC6 2.0/15.03.06.23. The affected element is an unknown function of the file /goform/telnet of the component httpd. The manipulation of the argument lan.ip leads to os command injection.
This vulnerability is referenced as CVE-2026-8259. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
Red Hat
kernel: bpf: Fix NULL-ptr-deref in btf_var_show()
vendor_redhat·2026-09-25·CVSS 5.5
CVE-2026-98063 [MEDIUM] CWE-476 kernel: bpf: Fix NULL-ptr-deref in btf_var_show()
kernel: bpf: Fix NULL-ptr-deref in btf_var_show()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix NULL-ptr-deref in btf_var_show()
btf_var_show() calls btf_type_id_resolve() unconditionally, which
dereferences btf->resolved_ids. That is NULL for a base BTF - e.g. the
vmlinux BTF that bpf_snprintf_btf() renders against - since base BTF is
not resolved during parsing. btf_modifier_show() guards this with
'if (btf->resolved_ids)', but btf_var_show() does not.
A BPF program that passes the type_id of a BTF_KIND_VAR from the vmlinux
BTF to bpf_snprintf_btf() thus NULL-derefs:
KASAN: probably user-memory-access in range [0x46638-0x4663f]
RIP: 0010:btf_var_show (kernel/bpf/btf.c:2929)
Call Trace:
btf_type_show (kernel/bpf/btf.c:8259)
btf_type_snprintf_show (kernel/b
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-98063 kernel: bpf: Fix NULL-ptr-deref in btf_var_show()
bugzilla·2026-09-25
CVE-2026-98063 [MEDIUM] CVE-2026-98063 kernel: bpf: Fix NULL-ptr-deref in btf_var_show()
CVE-2026-98063 kernel: bpf: Fix NULL-ptr-deref in btf_var_show()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix NULL-ptr-deref in btf_var_show()
btf_var_show() calls btf_type_id_resolve() unconditionally, which
dereferences btf->resolved_ids. That is NULL for a base BTF - e.g. the
vmlinux BTF that bpf_snprintf_btf() renders against - since base BTF is
not resolved during parsing. btf_modifier_show() guards this with
'if (btf->resolved_ids)', but btf_var_show() does not.
A BPF program that passes the type_id of a BTF_KIND_VAR from the vmlinux
BTF to bpf_snprintf_btf() thus NULL-derefs:
KASAN: probably user-memory-access in range [0x46638-0x4663f]
RIP: 0010:btf_var_show (kernel/bpf/btf.c:2929)
Call Trace:
btf_type_show (kernel/bpf/btf.c:8259)
btf_type_snpr
Bugzilla
CVE-2026-49844 org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values
bugzilla·2026-07-10·CVSS 7.5
CVE-2026-49844 [HIGH] CVE-2026-49844 org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values
CVE-2026-49844 org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.
The defect is reachable only when both of the following conditions hold:
* The application uses the message resolver https:/
Bugzilla
CVE-2026-34481 org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output
bugzilla·2026-04-10·CVSS 6.3
CVE-2026-34481 [MEDIUM] CVE-2026-34481 org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output
CVE-2026-34481 org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output
Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.
An attacker can exploit this issue only if both of the following conditions are met:
* The application uses JsonTemplateLayout.
* The application logs a MapMessage containing an attacker-controlled floating-point value.
Users are advised to upgrade to Apache Log4j JSON Template Layout 2.
2026-05-11
Published