CVE-2026-90714

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.8 is sufficient to resolve this issue. Patch name: 9b337c3eae5833c3956bed1fc01c21c14fd443f2. It is suggested to upgrade the affected component.

Scoring

Severity

MEDIUM

CVSS base score

6.5

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

EPSS probability

0.27%

CWE

CWE-119

Published

2026-09-14

Last modified

2026-09-15

Affected products

• marcobambini Gravity
• marcobambini Gravity
• marcobambini Gravity
• marcobambini Gravity
• marcobambini Gravity
• marcobambini Gravity
• marcobambini Gravity
• marcobambini Gravity

Weakness type

• CWE-119

Related vulnerabilities

• CVE-2026-87489 — Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitra
• CVE-2026-87444 — Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code
• CVE-2026-79069 — Memory corruption in Tint in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially exe
• CVE-2026-75784 — TRENDnet TEW-WLC100 HTTP Header nginx FUN_0040da4c stack-based overflow
• CVE-2026-82542 — Tenda HG10 Boa Web Server formIPv6Routing buffer overflow
• CVE-2026-79911 — TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow
• CVE-2026-77946 — TRENDnet TEW-821DAP NTP Timezone Configuration apply_time.cgi uci_safe_get stack-based overflow
• CVE-2026-86296 — D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow

Markdown version · Browse all CVEs