https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 23:34:44 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-00939 bdu:2026-00939 https://cve.radiocsirt.org/vuln/bdu:2026-00939 https://cve.radiocsirt.org/vuln/euvd-2026-318356 EUVD-2026-318356 https://cve.radiocsirt.org/vuln/euvd-2026-318356 https://cve.radiocsirt.org/vuln/fkie_cve-2026-24428 <p>Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an attacker can bypass role-based restrictions enforced by the web interface and obtain full administrative privileges.</p> <p>Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an attacker can bypass role-based restrictions enforced by the web interface and obtain full administrative privileges.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-24428 https://cve.radiocsirt.org/vuln/ghsa-ww5j-8g6w-h99h <p>Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an attacker can bypass role-based restrictions enforced by the web interface and obtain full administrative privileges.</p> <p>Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an attacker can bypass role-based restrictions enforced by the web interface and obtain full administrative privileges.</p> https://cve.radiocsirt.org/vuln/ghsa-ww5j-8g6w-h99h