CVE-2026-116836

HIGH8.8

Published 2026-10-27 · Source fe490ce8-0395-4072-90d8-2707e1bdf984

Description

A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device.

CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE-79

References

https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-071/7d4d42cf-09e4-44d3-9c19-649cac8c6af3

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-116843
Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.
2026-10-27 · score 8.8
CVE-2026-116839
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.
2026-10-27 · score 7.1
CVE-2026-116838
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.
2026-10-27 · score 8.8
CVE-2026-116837
A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
2026-10-27 · score 8.8
CVE-2026-116816
llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids before the bytes_ buffer during model loading, causing crashes or potential code execution.
2026-10-27 · score 7.8