CVE-2026-4492

A vulnerability was found in Tenda A18 Pro 02.03.02.28. The affected element is the function set_qosMib_list of the file /goform/formSetQosBand. Performing a manipulation of the argument list results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

• CWE-119
• CWE-121

• https://github.com/lilukun337/cve/issues/4
• https://vuldb.com/?ctiid.352018
• https://vuldb.com/?id.352018
• https://vuldb.com/?submit.773682
• https://www.tenda.com.cn/

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44914Apache NiFi 1.12.0 through 2.9.0 are missing authorization w…7.2
• CVE-2026-44915URL Redirection to Untrusted Site ('Open Redirect') vulnerab…6.1
• CVE-2026-44916In OpenStack Ironic before 35.0.2 (in a certain non-default …3
• CVE-2026-44917OpenStack Ironic before 35.0.2 allows a malicious authentica…4.9
• CVE-2026-44918OpenStack Ironic through before 37.0.1 allows creation or mo…5.5
• CVE-2026-44919In OpenStack Ironic through 35.x before a3f6d73, during imag…6.5
• CVE-2026-44923SQL injection in InfoScale VIOM before v9.1.3 allows remote …6.5
• CVE-2026-44924InfoScale VIOM 9.1.3 allows XSS.5.4
• CVE-2026-44925Cross-Site Request Forgery (CSRF) vulnerability in InfoScale…8.8
• CVE-2026-44926InfoScale CmdServer before 7.4.2 mishandles access control.8.8
• CVE-2026-44927In uriparser before 1.0.2, there is pointer difference trunc…5.3
• CVE-2026-44928In uriparser before 1.0.2, the function family EqualsUri can…5.3