Search
Find a vulnerability
Search criteria
71 vulnerabilities
CVE-2026-28199 (GCVE-0-2026-28199)
Vulnerability from cvelistv5 – Published: 2026-09-18 11:19 – Updated: 2026-09-18 14:31
VLAI
EPSS
VEX
Title
Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell
Summary
An authenticated user with access to the NetBackup Flex OS management
shell could read arbitrary files from the underlying operating system by
supplying a specially crafted path argument to a diagnostic command.
Successful exploitation could expose sensitive system configuration and
credential material stored on the appliance.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 14:14 UTC
CWE
- CWE-347 - Improper verification of cryptographic signature
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28199 | government-resource |
| https://github.com/cohesity/SecAdvisory/blob/mast… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cohesity | NetBackup Flex OS |
Affected:
0 , < 6.4
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28199",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T14:14:05.944780Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T14:31:45.190Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NetBackup Flex OS",
"vendor": "Cohesity",
"versions": [
{
"lessThan": "6.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Francesco Caserta (ACN)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated user with access to the NetBackup Flex OS management \nshell could read arbitrary files from the underlying operating system by\n supplying a specially crafted path argument to a diagnostic command. \nSuccessful exploitation could expose sensitive system configuration and \ncredential material stored on the appliance.\n\n\u003cbr\u003e"
}
],
"value": "An authenticated user with access to the NetBackup Flex OS management \nshell could read arbitrary files from the underlying operating system by\n supplying a specially crafted path argument to a diagnostic command. \nSuccessful exploitation could expose sensitive system configuration and \ncredential material stored on the appliance."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper verification of cryptographic signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T11:19:34.183Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28199"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0001.md"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Restrict management shell access to authorized administrators only. No \ncompensating control fully eliminates the risk; upgrading is required.\n\n\u003cbr\u003e"
}
],
"value": "Restrict management shell access to authorized administrators only. No \ncompensating control fully eliminates the risk; upgrading is required."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-28199",
"datePublished": "2026-09-18T11:19:34.183Z",
"dateReserved": "2026-02-25T14:02:29.493Z",
"dateUpdated": "2026-09-18T14:31:45.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28198 (GCVE-0-2026-28198)
Vulnerability from cvelistv5 – Published: 2026-09-18 11:12 – Updated: 2026-09-18 14:31
VLAI
EPSS
VEX
Title
Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell
Summary
An authenticated, low-privileged user with access to the NetBackup Flex
OS management shell could bypass the cryptographic signature
verification step of a privileged support command by supplying a
specially formed access credential. Successful exploitation grants the
attacker an unrestricted root shell with full control over the Flex
appliance host and all hosted containers, completely compromising
confidentiality, integrity, and availability.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 14:14 UTC
CWE
- CWE-347 - Improper verification of cryptographic signature
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28198 | government-resource |
| https://github.com/cohesity/SecAdvisory/blob/mast… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cohesity | NetBackup Flex OS |
Affected:
0 , < 6.4
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28198",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T14:14:16.330258Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T14:31:44.992Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NetBackup Flex OS",
"vendor": "Cohesity",
"versions": [
{
"lessThan": "6.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated, low-privileged user with access to the NetBackup Flex \nOS management shell could bypass the cryptographic signature \nverification step of a privileged support command by supplying a \nspecially formed access credential. Successful exploitation grants the \nattacker an unrestricted root shell with full control over the Flex \nappliance host and all hosted containers, completely compromising \nconfidentiality, integrity, and availability.\n\n\u003cbr\u003e"
}
],
"value": "An authenticated, low-privileged user with access to the NetBackup Flex \nOS management shell could bypass the cryptographic signature \nverification step of a privileged support command by supplying a \nspecially formed access credential. Successful exploitation grants the \nattacker an unrestricted root shell with full control over the Flex \nappliance host and all hosted containers, completely compromising \nconfidentiality, integrity, and availability."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper verification of cryptographic signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T11:12:23.941Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28198"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0001.md"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Restrict management shell access to authorized administrators only. No \ncompensating control fully eliminates the risk; upgrading is required."
}
],
"value": "Restrict management shell access to authorized administrators only. No \ncompensating control fully eliminates the risk; upgrading is required."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-28198",
"datePublished": "2026-09-18T11:12:23.941Z",
"dateReserved": "2026-02-25T14:02:29.493Z",
"dateUpdated": "2026-09-18T14:31:44.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28197 (GCVE-0-2026-28197)
Vulnerability from cvelistv5 – Published: 2026-09-18 11:07 – Updated: 2026-09-18 14:31
VLAI
EPSS
VEX
Title
Privilege Escalation via Argument Injection in NetBackup Flex OS Shell
Summary
An authenticated, low-privileged user with access to the NetBackup Flex
OS management shell could supply a specially crafted input to a
privileged administrative command, causing it to execute arbitrary code
with root-level permissions. Successful exploitation grants the attacker
unrestricted control over the Flex appliance host and all hosted
containers, fully compromising confidentiality, integrity, and
availability.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 14:14 UTC
CWE
- CWE-88 - Improper neutralization of argument delimiters in a command ('argument injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28197 | government-resource |
| https://github.com/cohesity/SecAdvisory/blob/mast… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cohesity | NetBackup Flex OS |
Affected:
0 , < 6.4
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28197",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T14:14:31.135668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T14:31:44.840Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NetBackup Flex OS",
"vendor": "Cohesity",
"versions": [
{
"lessThan": "6.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated, low-privileged user with access to the NetBackup Flex \nOS management shell could supply a specially crafted input to a \nprivileged administrative command, causing it to execute arbitrary code \nwith root-level permissions. Successful exploitation grants the attacker\n unrestricted control over the Flex appliance host and all hosted \ncontainers, fully compromising confidentiality, integrity, and \navailability."
}
],
"value": "An authenticated, low-privileged user with access to the NetBackup Flex \nOS management shell could supply a specially crafted input to a \nprivileged administrative command, causing it to execute arbitrary code \nwith root-level permissions. Successful exploitation grants the attacker\n unrestricted control over the Flex appliance host and all hosted \ncontainers, fully compromising confidentiality, integrity, and \navailability."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper neutralization of argument delimiters in a command (\u0027argument injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T11:07:19.877Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2026-28197"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0001.md"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Privilege Escalation via Argument Injection in NetBackup Flex OS Shell",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Restrict management shell access to authorized administrators only. No \ncompensating control fully eliminates the risk; upgrading is required."
}
],
"value": "Restrict management shell access to authorized administrators only. No \ncompensating control fully eliminates the risk; upgrading is required."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-28197",
"datePublished": "2026-09-18T11:07:19.877Z",
"dateReserved": "2026-02-25T14:02:29.492Z",
"dateUpdated": "2026-09-18T14:31:44.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89307 (GCVE-0-2026-89307)
Vulnerability from cvelistv5 – Published: 2026-09-15 15:23 – Updated: 2026-09-15 17:31
VLAI
EPSS
VEX
Title
HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme
Summary
The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 17:16 UTC
CWE
- CWE-601 - URL redirection to untrusted site ('open redirect')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/italia/design-scuole-wordpress-theme | product |
| https://www.acn.gov.it/portale/w/rilevate-vulnera… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Developers Italia | design-scuole-wordpress-theme |
Affected:
1.0 , ≤ 2.17.3
(semver)
cpe:2.3:a:developers_italia:design-scuole-wordpress-theme:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89307",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T17:16:36.848070Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T17:31:45.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "design-scuole-wordpress-theme",
"repo": "https://github.com/italia/design-scuole-wordpress-theme",
"vendor": "Developers Italia",
"versions": [
{
"lessThanOrEqual": "2.17.3",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:developers_italia:design-scuole-wordpress-theme:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.17.3",
"versionStartIncluding": "1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lorenzo Zarfati"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The \"Firma Circolare\" feature in the \"Design Scuole Italia\" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect)."
}
],
"value": "The \"Firma Circolare\" feature in the \"Design Scuole Italia\" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect)."
}
],
"impacts": [
{
"capecId": "CAPEC-98",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-98 Phishing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL redirection to untrusted site (\u0027open redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:23:40.292Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/italia/design-scuole-wordpress-theme"
},
{
"tags": [
"government-resource"
],
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-89307",
"datePublished": "2026-09-15T15:23:40.292Z",
"dateReserved": "2026-09-11T13:54:43.619Z",
"dateUpdated": "2026-09-15T17:31:45.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87793 (GCVE-0-2026-87793)
Vulnerability from cvelistv5 – Published: 2026-09-15 15:21 – Updated: 2026-09-15 17:31
VLAI
EPSS
VEX
Title
Reflected XSS in WordPress theme design-scuole-wordpress-theme
Summary
The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file,
allowing an unauthenticated attacker to execute arbitrary JavaScript in
a victim's browser via a crafted URL containing a malicious archive parameter.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 17:16 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/italia/design-scuole-wordpress-theme | product |
| https://www.acn.gov.it/portale/w/rilevate-vulnera… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Developers Italia | design-scuole-wordpress-theme |
Affected:
1.0 , ≤ 2.18.2
(semver)
cpe:2.3:a:developers_italia:design-scuole-wordpress-theme:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87793",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T17:16:46.753126Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T17:31:45.479Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "design-scuole-wordpress-theme",
"repo": "https://github.com/italia/design-scuole-wordpress-theme",
"vendor": "Developers Italia",
"versions": [
{
"lessThanOrEqual": "2.18.2",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:developers_italia:design-scuole-wordpress-theme:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.18.2",
"versionStartIncluding": "1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lorenzo Zarfati"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The \"Design Scuole Italia\" WordPress theme is affected by a Reflected XSS vulnerability in the\u0026nbsp;\u003ccode\u003efilters-scheda-didattica.php\u003c/code\u003e\u0026nbsp;file,\n allowing an unauthenticated attacker to execute arbitrary JavaScript in\n a victim\u0027s browser via a crafted URL containing a malicious\u0026nbsp;\u003ccode\u003earchive\u003c/code\u003e\u0026nbsp;parameter."
}
],
"value": "The \"Design Scuole Italia\" WordPress theme is affected by a Reflected XSS vulnerability in the\u00a0filters-scheda-didattica.php\u00a0file,\n allowing an unauthenticated attacker to execute arbitrary JavaScript in\n a victim\u0027s browser via a crafted URL containing a malicious\u00a0archive\u00a0parameter."
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-591 Reflected XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:21:47.322Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/italia/design-scuole-wordpress-theme"
},
{
"tags": [
"government-resource"
],
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cblockquote\u003e\u003cp\u003eTo fix the vulnerability, replace \u003ccode\u003e\u0026lt;?php echo $archive; ?\u0026gt;\u003c/code\u003e with \u003ccode\u003e\u0026lt;?php echo esc_attr($archive); ?\u0026gt;\u003c/code\u003e in both affected files.\u003c/p\u003e\n\u003c/blockquote\u003e\n\n\n\u003cbr\u003e"
}
],
"value": "To fix the vulnerability, replace \u003c?php echo $archive; ?\u003e with \u003c?php echo esc_attr($archive); ?\u003e in both affected files."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reflected XSS in WordPress theme design-scuole-wordpress-theme",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-87793",
"datePublished": "2026-09-15T15:21:47.322Z",
"dateReserved": "2026-09-09T09:28:48.222Z",
"dateUpdated": "2026-09-15T17:31:45.479Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87792 (GCVE-0-2026-87792)
Vulnerability from cvelistv5 – Published: 2026-09-15 15:20 – Updated: 2026-09-15 17:31
VLAI
EPSS
VEX
Title
Multiple authorization bypass in WordPress theme design-scuole-wordpress-theme
Summary
The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed at /circolare/feed/ further facilitates exploitation.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 17:17 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.acn.gov.it/portale/w/rilevate-vulnera… | government-resource |
| https://github.com/italia/design-scuole-wordpress-theme | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Developers Italia | design-scuole-wordpress-theme |
Affected:
1.0 , ≤ 2.17.3
(semver)
cpe:2.3:a:developers_italia:design-scuole-wordpress-theme:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87792",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T17:17:00.469779Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T17:31:45.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "design-scuole-wordpress-theme",
"repo": "https://github.com/italia/design-scuole-wordpress-theme",
"vendor": "Developers Italia",
"versions": [
{
"lessThanOrEqual": "2.17.3",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:developers_italia:design-scuole-wordpress-theme:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.17.3",
"versionStartIncluding": "1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Filippo Sorbellini"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The \"Design Scuole Italia\" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the\u0026nbsp;\u003ccode\u003edsi_pdf_generator\u003c/code\u003e\u0026nbsp;and\u0026nbsp;\u003ccode\u003edsi_csv_generator\u003c/code\u003e\u0026nbsp;functions, allowing an unauthenticated attacker to access restricted \"Circolare\" content and registered users\u0027 data. An unauthenticated RSS feed at\u0026nbsp;\u003ccode\u003e/circolare/feed/\u003c/code\u003e\u0026nbsp;further facilitates exploitation."
}
],
"value": "The \"Design Scuole Italia\" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the\u00a0dsi_pdf_generator\u00a0and\u00a0dsi_csv_generator\u00a0functions, allowing an unauthenticated attacker to access restricted \"Circolare\" content and registered users\u0027 data. An unauthenticated RSS feed at\u00a0/circolare/feed/\u00a0further facilitates exploitation."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:20:17.877Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-"
},
{
"tags": [
"product"
],
"url": "https://github.com/italia/design-scuole-wordpress-theme"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Multiple authorization bypass in WordPress theme design-scuole-wordpress-theme",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-87792",
"datePublished": "2026-09-15T15:20:17.877Z",
"dateReserved": "2026-09-09T09:28:48.222Z",
"dateUpdated": "2026-09-15T17:31:45.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87791 (GCVE-0-2026-87791)
Vulnerability from cvelistv5 – Published: 2026-09-15 15:10 – Updated: 2026-09-15 17:31
VLAI
EPSS
VEX
Title
Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme
Summary
A path traversal vulnerability exists in the reserved_file_check function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 17:17 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/italia/design-scuole-wordpress-theme | product |
| https://www.acn.gov.it/portale/w/rilevate-vulnera… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Developers Italia | design-scuole-wordpress-theme |
Affected:
2.6.0 , ≤ 2.18.1
(semver)
cpe:2.3:a:developers_italia:design-scuole-wordpress-theme:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87791",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T17:17:30.522591Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T17:31:45.818Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "design-scuole-wordpress-theme",
"repo": "https://github.com/italia/design-scuole-wordpress-theme",
"vendor": "Developers Italia",
"versions": [
{
"lessThanOrEqual": "2.18.1",
"status": "affected",
"version": "2.6.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:developers_italia:design-scuole-wordpress-theme:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.18.1",
"versionStartIncluding": "2.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Filippo Sorbellini"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eA path traversal vulnerability exists in the \u003ccode\u003ereserved_file_check\u003c/code\u003e function of the\u0026nbsp;\u003ccode\u003efunctions.php\u003c/code\u003e\u0026nbsp;file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process.\u003c/div\u003e"
}
],
"value": "A path traversal vulnerability exists in the reserved_file_check function of the\u00a0functions.php\u00a0file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:10:37.613Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/italia/design-scuole-wordpress-theme"
},
{
"tags": [
"government-resource"
],
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to version 2.18.2"
}
],
"value": "Update to version 2.18.2"
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T07:03:00.000Z",
"value": "patched in v2.18.2"
}
],
"title": "Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-87791",
"datePublished": "2026-09-15T15:10:37.613Z",
"dateReserved": "2026-09-09T09:28:48.222Z",
"dateUpdated": "2026-09-15T17:31:45.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89308 (GCVE-0-2026-89308)
Vulnerability from cvelistv5 – Published: 2026-09-15 11:44 – Updated: 2026-09-15 12:30
VLAI
EPSS
VEX
Title
Arbitrary command execution in TrxTimeATTENDANCE
Summary
An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to execute arbitrary commands on the underlying operating system and achieve remote code execution.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 12:30 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.trexom.net/sviluppo-di-app/ | product |
| https://www.acn.gov.it/portale/w/trexom-aggiornam… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TREXOM | TrxTimeATTENDANCE |
Affected:
1.0.5 , < 1.9.6
(semver)
cpe:2.3:a:trexom:trxtimeattendance:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89308",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T12:30:47.734324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T12:30:57.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TrxTimeATTENDANCE",
"vendor": "TREXOM",
"versions": [
{
"lessThan": "1.9.6",
"status": "affected",
"version": "1.0.5",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:trexom:trxtimeattendance:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.9.5",
"versionStartIncluding": "1.0.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "@VolpinaRegina"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eAn unauthenticated OS command injection vulnerability exists in the\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003ccode\u003eping.php\u003c/code\u003e\u003cspan\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003eendpoint, allowing remote attackers to execute arbitrary commands on the underlying operating system and achieve remote code execution.\u003c/span\u003e"
}
],
"value": "An unauthenticated OS command injection vulnerability exists in the\u00a0ping.php\u00a0endpoint, allowing remote attackers to execute arbitrary commands on the underlying operating system and achieve remote code execution."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T11:44:00.803Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.trexom.net/sviluppo-di-app/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.acn.gov.it/portale/w/trexom-aggiornamenti-di-sicurezza"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to version 1.9.6"
}
],
"value": "Update to version 1.9.6"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Arbitrary command execution in TrxTimeATTENDANCE",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Block all HTTP requests to the ping.php endpoint at the web server or firewall level."
}
],
"value": "Block all HTTP requests to the ping.php endpoint at the web server or firewall level."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-89308",
"datePublished": "2026-09-15T11:44:00.803Z",
"dateReserved": "2026-09-11T13:54:43.619Z",
"dateUpdated": "2026-09-15T12:30:57.222Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59111 (GCVE-0-2026-59111)
Vulnerability from cvelistv5 – Published: 2026-08-31 14:43 – Updated: 2026-08-31 15:53
VLAI
EPSS
VEX
Title
Command Injection vulnerability in eObčanka-Identifikace
Summary
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 15:08 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://info.identita.gov.cz/eop/BezpecnostniOzna… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ministry of the Interior (MVČR) | eObčanka-Identifikace |
Affected:
0 , ≤ 3.5.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59111",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T15:08:06.355634Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T15:08:17.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"MacOS"
],
"product": "eOb\u010danka-Identifikace",
"vendor": "Ministry of the Interior (MV\u010cR)",
"versions": [
{
"lessThanOrEqual": "3.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027) vulnerability in Digit\u00e1ln\u00ed a informa\u010dn\u00ed agentura (DIA) eOb\u010danka-Identifikace on MacOS enables an attacker to\u0026nbsp;\u003cspan\u003eregister a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization.\u003c/span\u003e"
}
],
"value": "Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027) vulnerability in Digit\u00e1ln\u00ed a informa\u010dn\u00ed agentura (DIA) eOb\u010danka-Identifikace on MacOS enables an attacker to\u00a0register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T15:53:35.691Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://info.identita.gov.cz/eop/BezpecnostniOznameni/CVE-2026-59111.aspx"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "remediated in v3.6.0 (Released: 2026-05-13) - Implemented AppleScript sanitization\u003cbr\u003efixed in v3.7.0 (Released: 2026-07-17) - AppleScript was completely removed from the bundle"
}
],
"value": "remediated in v3.6.0 (Released: 2026-05-13) - Implemented AppleScript sanitization\nfixed in v3.7.0 (Released: 2026-07-17) - AppleScript was completely removed from the bundle"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Command Injection vulnerability in eOb\u010danka-Identifikace",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-59111",
"datePublished": "2026-08-31T14:43:02.777Z",
"dateReserved": "2026-07-02T15:47:36.965Z",
"dateUpdated": "2026-08-31T15:53:35.691Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70383 (GCVE-0-2026-70383)
Vulnerability from cvelistv5 – Published: 2026-08-20 14:04 – Updated: 2026-08-26 19:51
VLAI
EPSS
VEX
Title
Arbitrary file overwrite vulnerability in DigiDoc4 client
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client.
This issue affects DigiDoc4: from 4.0.0 before 4.11.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 19:43 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Estonian Information System Authority (RIA) | DigiDoc4 |
Affected:
4.0.0 , < 4.11.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70383",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T19:43:29.497162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T19:51:08.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DigiDoc4",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "4.11.0",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Siva Aditya Panuganti, Aditya Security Labs"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client.\u003cp\u003eThis issue affects DigiDoc4: from 4.0.0 before 4.11.0.\u003c/p\u003e"
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client.\n\nThis issue affects DigiDoc4: from 4.0.0 before 4.11.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T14:04:15.480Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/open-eid/libdigidocpp/pull/736"
},
{
"tags": [
"patch"
],
"url": "https://github.com/open-eid/DigiDoc4-Client/pull/1402"
},
{
"tags": [
"product"
],
"url": "https://github.com/open-eid/DigiDoc4-Client"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Arbitrary file overwrite vulnerability in DigiDoc4 client",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-70383",
"datePublished": "2026-08-20T14:04:15.480Z",
"dateReserved": "2026-08-04T07:41:00.082Z",
"dateUpdated": "2026-08-26T19:51:08.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22306 (GCVE-0-2026-22306)
Vulnerability from cvelistv5 – Published: 2026-08-19 19:25 – Updated: 2026-08-26 19:29
VLAI
EPSS
VEX
Title
Critical flaw impacting OZOLS ERP's automatic update channel
Summary
Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext
transmission of sensitive information vulnerability in Ozols Grupa OZOLS
on Windows caused by an abandoned auto-update domain. Affected
component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs.
This issue affects OZOLS: before 1.1.1233.
Severity
10 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 19:29 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://offseq.com/en/research/ozols-cve-2026-22306 | third-party-advisory |
| https://offseq.com/en/research/ozols-cve-2026-223… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ozols Grupa | OZOLS |
Affected:
0 , < 1.1.1233
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22306",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T19:29:24.039857Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T19:29:42.941Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://offseq.com/en/research/ozols-cve-2026-22306/#s-04"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "OZOLS",
"vendor": "Ozols Grupa",
"versions": [
{
"lessThan": "1.1.1233",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nils Putni\u0146\u0161, OffSeq (SIA SEQ)"
},
{
"lang": "en",
"type": "coordinator",
"value": "CERT.LV"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext \ntransmission of sensitive information vulnerability in Ozols Grupa OZOLS\n on Windows caused by an\u0026nbsp;\u003cspan\u003eabandoned auto-update domain\u003c/span\u003e.\u0026nbsp;\u003cspan\u003eAffected\ncomponent: the automatic update channel -\u0026nbsp;\u003c/span\u003e\u003cspan\u003eOzolsSQL\u003c/span\u003e\u003cspan\u003e\u0026nbsp;client update path, the\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\u0026lt;db\u0026gt;_update\u003c/span\u003e\u003cspan\u003e\u0026nbsp;SQL Server Agent job (\u003c/span\u003e\u003cspan\u003e@subsystem = N\u0027ActiveScripting\u0027\u003c/span\u003e\u003cspan\u003e) and\u0026nbsp;\u003c/span\u003e\u003cspan\u003eserv_update.vbs\u003c/span\u003e\u003cspan\u003e.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003eThis issue affects OZOLS: before 1.1.1233."
}
],
"value": "Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext \ntransmission of sensitive information vulnerability in Ozols Grupa OZOLS\n on Windows caused by an\u00a0abandoned auto-update domain.\u00a0Affected\ncomponent: the automatic update channel -\u00a0OzolsSQL\u00a0client update path, the\u00a0\u003cdb\u003e_update\u00a0SQL Server Agent job (@subsystem = N\u0027ActiveScripting\u0027) and\u00a0serv_update.vbs.\n\nThis issue affects OZOLS: before 1.1.1233."
}
],
"impacts": [
{
"capecId": "CAPEC-186",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-186 Malicious Software Update"
}
]
},
{
"capecId": "CAPEC-187",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-187 Malicious Automated Software Update via Redirection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-494",
"description": "CWE-494 Download of code without integrity check",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829 Inclusion of functionality from untrusted control sphere",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319 Cleartext transmission of sensitive information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T19:25:10.530Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://offseq.com/en/research/ozols-cve-2026-22306"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Critical flaw impacting OZOLS ERP\u0027s automatic update channel",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003e\u003cspan\u003edisable\n or delete the\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\u0026lt;db\u0026gt;_update\u003c/span\u003e\u003cspan\u003e\u0026nbsp;SQL\n Server Agent job and remove\u0026nbsp;\u003c/span\u003e\u003cspan\u003eserv_update.vbs\u003c/span\u003e\u003cspan\u003e;\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eblock\n outbound access from database servers and workstations to\u0026nbsp;\u003c/span\u003e\u003cspan\u003eits2.lv\u003c/span\u003e\u003cspan\u003e\u0026nbsp;/\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewww2.its2.lv\u003c/span\u003e\u003cspan\u003e, and\n restrict arbitrary outbound HTTP from those hosts;\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003edisable\u0026nbsp;\u003c/span\u003e\u003cspan\u003exp_cmdshell\u003c/span\u003e\u003cspan\u003e\u0026nbsp;on\n affected SQL Server instances;\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003erun the\n SQL Server service under a least-privilege account;\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003einspect\n the\u0026nbsp;\u003c/span\u003e\u003cspan\u003esprg\u003c/span\u003e\u003cspan\u003e\u0026nbsp;table\n for unexpected version increments or archive contents.\u003c/span\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "* disable\n or delete the\u00a0\u003cdb\u003e_update\u00a0SQL\n Server Agent job and remove\u00a0serv_update.vbs;\n * block\n outbound access from database servers and workstations to\u00a0its2.lv\u00a0/\u00a0www2.its2.lv, and\n restrict arbitrary outbound HTTP from those hosts;\n * disable\u00a0xp_cmdshell\u00a0on\n affected SQL Server instances;\n * run the\n SQL Server service under a least-privilege account;\n * inspect\n the\u00a0sprg\u00a0table\n for unexpected version increments or archive contents."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-22306",
"datePublished": "2026-08-19T19:25:10.530Z",
"dateReserved": "2026-01-07T09:31:00.562Z",
"dateUpdated": "2026-08-26T19:29:42.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59109 (GCVE-0-2026-59109)
Vulnerability from cvelistv5 – Published: 2026-08-13 16:40 – Updated: 2026-08-14 17:46
VLAI
EPSS
VEX
Title
Zalktis: SQL injection via partner-controlled fields in imported e-invoices
Summary
SQL injection in the Zalktis accounting application via
trading-partner-controlled text fields in received electronic invoices. When
importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis
concatenates partner-controlled values directly into SQL statement text using
string concatenation, with neither parameterised queries nor escaping. The
application's own escaping helper, Dazadi.sql_txt(),
is not invoked on these code paths, so a party that sends an invoice can break
out of the string literal and alter the query logic.
This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 17:46 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://offseq.com/en/research/zalktis-cve-2026-59109 | technical-description |
| https://cvd.cert.lv/disclosed/vuln-all-631428755 | government-resourcepermissions-required |
| https://offseq.com/en/research/zalktis-cve-2026-59109/ | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zalktis Programmas (SIA "Zalktis Programmas") | Zalktis |
Affected:
0 , < 2026.1.586
(semver)
Affected: 0 , < 2026.2.592 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59109",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T17:46:01.133135Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T17:46:15.377Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://offseq.com/en/research/zalktis-cve-2026-59109/"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Zalktis",
"vendor": "Zalktis Programmas (SIA \"Zalktis Programmas\")",
"versions": [
{
"lessThan": "2026.1.586",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2026.2.592",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nils Putni\u0146\u0161, OffSeq (SIA SEQ)"
},
{
"lang": "en",
"type": "coordinator",
"value": "CERT-LV"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eSQL injection in the Zalktis accounting application via\ntrading-partner-controlled text fields in received electronic invoices. When\nimporting a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis\nconcatenates partner-controlled values directly into SQL statement text using\nstring concatenation, with neither parameterised queries nor escaping. The\napplication\u0027s own escaping helper,\u0026nbsp;\u003c/span\u003e\u003ccode\u003e\u003cspan\u003eDazadi.sql_txt()\u003c/span\u003e\u003c/code\u003e\u003cspan\u003e,\nis not invoked on these code paths, so a party that sends an invoice can break\nout of the string literal and alter the query logic.\u003c/span\u003e\u003c/p\u003e\n\n\n\n\n\n\u003cp\u003eThis issue affects Zalktis: before 2026.1.586 and before 2026.2.592.\u003c/p\u003e"
}
],
"value": "SQL injection in the Zalktis accounting application via\ntrading-partner-controlled text fields in received electronic invoices. When\nimporting a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis\nconcatenates partner-controlled values directly into SQL statement text using\nstring concatenation, with neither parameterised queries nor escaping. The\napplication\u0027s own escaping helper,\u00a0Dazadi.sql_txt(),\nis not invoked on these code paths, so a party that sends an invoice can break\nout of the string literal and alter the query logic.\n\n\n\n\n\n\n\n\n\nThis issue affects Zalktis: before 2026.1.586 and before 2026.2.592."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
},
{
"capecId": "CAPEC-7",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-7 Blind SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:40:01.751Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://offseq.com/en/research/zalktis-cve-2026-59109"
},
{
"tags": [
"government-resource",
"permissions-required"
],
"url": "https://cvd.cert.lv/disclosed/vuln-all-631428755"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eThe vendor addressed the issue by parameterising the affected\nqueries. Upgrade to 2026.1.586 (legacy branch) or 2026.2.592 (current branch)\nor later.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "The vendor addressed the issue by parameterising the affected\nqueries. Upgrade to 2026.1.586 (legacy branch) or 2026.2.592 (current branch)\nor later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Zalktis: SQL injection via partner-controlled fields in imported e-invoices",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eUntil a fixed build is deployed: do not import e-invoices or\ne-commerce exports received from untrusted senders, and keep restorable backups\nof the accounting database taken before any import.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "Until a fixed build is deployed: do not import e-invoices or\ne-commerce exports received from untrusted senders, and keep restorable backups\nof the accounting database taken before any import."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-59109",
"datePublished": "2026-08-13T16:40:01.751Z",
"dateReserved": "2026-07-02T15:47:36.965Z",
"dateUpdated": "2026-08-14T17:46:15.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59112 (GCVE-0-2026-59112)
Vulnerability from cvelistv5 – Published: 2026-08-10 13:57 – Updated: 2026-08-10 17:55
VLAI
EPSS
VEX
Title
Signature validation vulnerability affecting DigiDoc applications
Summary
Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 17:55 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/open-eid/libdigidocpp/pull/690 | patch |
| https://www.id.ee/en/article/ria-soovitab-kasutaj… | vendor-advisory |
| https://www.ria.ee/blogi/digidoc-rakendustes-esin… | government-resource |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Estonian Information System Authority (RIA) | libdigidocpp |
Affected:
4.1.0 , < 4.2.1
(semver)
|
|
| Estonian Information System Authority (RIA) | DigiDoc4 |
Affected:
4.7.0 , < 4.8.2
(semver)
|
|
| Estonian Information System Authority (RIA) | DigiDoc |
Affected:
2.7.0 , < 2.7.2
(semver)
|
|
| Estonian Information System Authority (RIA) | DigiDoc |
Affected:
2.8.0 , < 2.8.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59112",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:55:03.112154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:55:30.587Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-eid/libdigidocpp/pull/690"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libdigidocpp",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "4.2.1",
"status": "affected",
"version": "4.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DigiDoc4",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "4.8.2",
"status": "affected",
"version": "4.7.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "DigiDoc",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "2.7.2",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"iOS"
],
"product": "DigiDoc",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "2.8.1",
"status": "affected",
"version": "2.8.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Burak Can Kus \u0026 Aleksander Kamenik (Cybernetica)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS.\u0026nbsp;This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1."
}
],
"value": "Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS.\u00a0This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper verification of cryptographic signature",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T13:57:37.159Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/open-eid/libdigidocpp/pull/690"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.id.ee/en/article/ria-soovitab-kasutajatel-uuendada-id-tarkvara-eng/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.ria.ee/blogi/digidoc-rakendustes-esinenud-turvanorkus-mis-juhtus-ja-kuidas-see-parandati"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eSystems integrating libdigidocpp should update to\nversion 4.2.1 or later.\u0026nbsp;\u003cbr\u003eUsers of DigiDoc applications should update to fixed\nversions provided by the vendor:\u0026nbsp;\u003cbr\u003eDigiDoc4 - 4.8.2 or later, RIA DigiDoc Android\n- 2.7.2 or later, and RIA DigiDoc iOS - 2.8.1 or later.\u0026nbsp;\u003cbr\u003eSignatures that were validated\nwith the vulnerable software versions should be revalidated.\u003c/span\u003e"
}
],
"value": "Systems integrating libdigidocpp should update to\nversion 4.2.1 or later.\u00a0\nUsers of DigiDoc applications should update to fixed\nversions provided by the vendor:\u00a0\nDigiDoc4 - 4.8.2 or later, RIA DigiDoc Android\n- 2.7.2 or later, and RIA DigiDoc iOS - 2.8.1 or later.\u00a0\nSignatures that were validated\nwith the vulnerable software versions should be revalidated."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Signature validation vulnerability affecting DigiDoc applications",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-59112",
"datePublished": "2026-08-10T13:57:37.159Z",
"dateReserved": "2026-07-02T15:47:36.965Z",
"dateUpdated": "2026-08-10T17:55:30.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0392 (GCVE-0-2026-0392)
Vulnerability from cvelistv5 – Published: 2026-08-03 09:56 – Updated: 2026-08-05 09:29
VLAI
EPSS
VEX
Title
eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update
Summary
eParakstītājs 3.0 for Windows before version
1.10.0 retrieves and executes its automatic updates over a channel that is not
authenticated or integrity-protected. On each launch the application fetches an
update descriptor (XML) over TLS but accepts any TLS certificate (a permissive
TrustManager and a HostnameVerifier that always returns true), does not verify
any digital signature on the update descriptor, and does not verify the
Authenticode signature or a checksum of the downloaded installer before running
it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a
crafted update descriptor pointing to an attacker-controlled executable, which
the client downloads and executes, resulting in arbitrary code execution on the
victim host.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 10:35 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.eparaksts.lv/lv/par_mums/Jaunumi/Jaun… | vendor-advisoryrelease-notes |
| https://cvd.cert.lv/inbox/view/vuln-all-1689187061 | government-resourcethird-party-advisorypermissions-required |
| https://offseq.com/en/research/eparakstitajs-cve-… | technical-descriptionthird-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Latvijas Valsts radio un televīzijas centrs (LVRTC) | eParakstītājs 3.0 |
Affected:
0 , < 1.10.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0392",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T10:35:21.949793Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T10:41:43.673Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "eParakst\u012bt\u0101js 3.0",
"vendor": "Latvijas Valsts radio un telev\u012bzijas centrs (LVRTC)",
"versions": [
{
"lessThan": "1.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nils Putni\u0146\u0161, OffSeq (SIA SEQ)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eeParakst\u012bt\u0101js 3.0 for Windows before version\n1.10.0 retrieves and executes its automatic updates over a channel that is not\nauthenticated or integrity-protected. On each launch the application fetches an\nupdate descriptor (XML) over TLS but accepts any TLS certificate (a permissive\nTrustManager and a HostnameVerifier that always returns true), does not verify\nany digital signature on the update descriptor, and does not verify the\nAuthenticode signature or a checksum of the downloaded installer before running\nit. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a\ncrafted update descriptor pointing to an attacker-controlled executable, which\nthe client downloads and executes, resulting in arbitrary code execution on the\nvictim host.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "eParakst\u012bt\u0101js 3.0 for Windows before version\n1.10.0 retrieves and executes its automatic updates over a channel that is not\nauthenticated or integrity-protected. On each launch the application fetches an\nupdate descriptor (XML) over TLS but accepts any TLS certificate (a permissive\nTrustManager and a HostnameVerifier that always returns true), does not verify\nany digital signature on the update descriptor, and does not verify the\nAuthenticode signature or a checksum of the downloaded installer before running\nit. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a\ncrafted update descriptor pointing to an attacker-controlled executable, which\nthe client downloads and executes, resulting in arbitrary code execution on the\nvictim host."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-494",
"description": "CWE-494 Download of code without integrity check",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper certificate validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper verification of cryptographic signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T09:29:36.104Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory",
"release-notes"
],
"url": "https://www.eparaksts.lv/lv/par_mums/Jaunumi/Jauna_eParakstitajs_30_versija_1100"
},
{
"tags": [
"government-resource",
"third-party-advisory",
"permissions-required"
],
"url": "https://cvd.cert.lv/inbox/view/vuln-all-1689187061"
},
{
"tags": [
"technical-description",
"third-party-advisory"
],
"url": "https://offseq.com/en/research/eparakstitajs-cve-2026-0392/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eUpdate eParakst\u012bt\u0101js 3.0 to\nversion 1.10.0 or later, in which the update channel is authenticated and the\ndownloaded installer is signature-verified.\u003c/span\u003e"
}
],
"value": "Update eParakst\u012bt\u0101js 3.0 to\nversion 1.10.0 or later, in which the update channel is authenticated and the\ndownloaded installer is signature-verified."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "eParakst\u012bt\u0101js 3.0 for Windows \u2013 remote code execution via unauthenticated auto-update",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eUntil updated, disable\nautomatic updates and install new versions only from the official signed\npackage obtained over a trusted network, verifying the Authenticode signature\nmanually.\u003c/span\u003e"
}
],
"value": "Until updated, disable\nautomatic updates and install new versions only from the official signed\npackage obtained over a trusted network, verifying the Authenticode signature\nmanually."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-0392",
"datePublished": "2026-08-03T09:56:31.363Z",
"dateReserved": "2025-11-27T11:36:47.937Z",
"dateUpdated": "2026-08-05T09:29:36.104Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33591 (GCVE-0-2026-33591)
Vulnerability from cvelistv5 – Published: 2026-08-03 09:35 – Updated: 2026-08-03 10:51
VLAI
EPSS
VEX
Title
Authentication bypass on WaptServer
Summary
A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass
security restriction using a specially crafted packet and retrieve a valid
session token for the targeted account.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 10:47 UTC
CWE
- CWE-288 - Authentication bypass using an alternate path or channel
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.wapt.fr/en/doc/wapt-changelog.html#wa… | release-notes |
| https://www.wapt.fr/en/doc/wapt-changelog.html#wa… | release-notes |
| https://www.wapt.fr/en/doc/wapt-security-bulletin.html | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tranquil IT Systems | WAPT Server |
Affected:
2.6.0.16767 , ≤ 2.6.1.17787
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33591",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T10:47:28.385447Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T10:51:35.202Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WAPT Server",
"vendor": "Tranquil IT Systems",
"versions": [
{
"lessThanOrEqual": "2.6.1.17787",
"status": "affected",
"version": "2.6.0.16767",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Brian CHERVY, System Engineer from Antiane, R\u00e9union Team, https://antiane.com"
},
{
"lang": "en",
"type": "coordinator",
"value": "CERT-FR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eA vulnerability in Wapt Server before version 2.6.1.17813 allows a\u003cspan\u003e\u0026nbsp; \u003c/span\u003eremote unauthenticated attacker to bypass\nsecurity restriction using a specially crafted packet and retrieve a valid\nsession token for the targeted account.\u003c/span\u003e"
}
],
"value": "A vulnerability in Wapt Server before version 2.6.1.17813 allows a\u00a0 remote unauthenticated attacker to bypass\nsecurity restriction using a specially crafted packet and retrieve a valid\nsession token for the targeted account."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication bypass using an alternate path or channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T09:35:40.648Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://www.wapt.fr/en/doc/wapt-changelog.html#wapt-2-6-0-16856-2026-06-09"
},
{
"tags": [
"release-notes"
],
"url": "https://www.wapt.fr/en/doc/wapt-changelog.html#wapt-2-6-1-17813-2026-06-09"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.wapt.fr/en/doc/wapt-security-bulletin.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authentication bypass on WaptServer",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-33591",
"datePublished": "2026-08-03T09:35:40.648Z",
"dateReserved": "2026-03-23T12:53:47.475Z",
"dateUpdated": "2026-08-03T10:51:35.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11946 (GCVE-0-2026-11946)
Vulnerability from cvelistv5 – Published: 2026-07-02 10:54 – Updated: 2026-07-02 12:15
VLAI
EPSS
VEX
Title
GetEndpoints Memory Exhaustion in open62541
Summary
An unauthenticated remote attacker can exhaust
server memory via the GetEndpoints Discovery Service in open62541. The
endpointUrl field of GetEndpointsRequest is not validated for length. An
attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32
length field) delivered across intermediate chunks without ever sending the
final chunk. The server buffers all chunks in RAM indefinitely until the
SecureChannel times out. The attack is
pre-session and bypasses all encryption configurations.
The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-02 12:15 UTC
CWE
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open62541 project / o6 Automation GmbH | open62541 |
Affected:
1.4.0 , ≤ 1.4.16
(semver)
Affected: 1.5.0 , ≤ 1.5.4 (semver) Affected: master (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11946",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-02T12:15:40.618622Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T12:15:49.245Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "open62541",
"vendor": "open62541 project / o6 Automation GmbH",
"versions": [
{
"lessThanOrEqual": "1.4.16",
"status": "affected",
"version": "1.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.5.4",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "master",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lorenzo Cannella from Fondazione Ugo Bordoni (FUB)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eAn unauthenticated remote attacker can exhaust\nserver memory via the GetEndpoints Discovery Service in open62541. The\nendpointUrl field of GetEndpointsRequest is not validated for length. An\nattacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32\nlength field) delivered across intermediate chunks without ever sending the\nfinal chunk. The server buffers all chunks in RAM indefinitely until the\nSecureChannel times out. The attack is\npre-session and bypasses all encryption configurations.\u003c/span\u003e\n\n\n\n\u003cspan\u003eThe\u0026nbsp;\u003c/span\u003eissue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master."
}
],
"value": "An unauthenticated remote attacker can exhaust\nserver memory via the GetEndpoints Discovery Service in open62541. The\nendpointUrl field of GetEndpointsRequest is not validated for length. An\nattacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32\nlength field) delivered across intermediate chunks without ever sending the\nfinal chunk. The server buffers all chunks in RAM indefinitely until the\nSecureChannel times out. The attack is\npre-session and bypasses all encryption configurations.\n\n\n\nThe\u00a0issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of resources without limits or throttling",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory allocation with excessive size value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T10:54:17.782Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/open62541/open62541/pull/8142"
},
{
"tags": [
"patch"
],
"url": "https://github.com/open62541/open62541/pull/8142/changes/d253818d6c5e870e1db0e360b18138c8bdc809ae"
},
{
"tags": [
"product"
],
"url": "https://github.com/open62541/open62541"
}
],
"source": {
"advisory": "SA-2026-0002",
"discovery": "UNKNOWN"
},
"title": "GetEndpoints Memory Exhaustion in open62541",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-11946",
"datePublished": "2026-07-02T10:54:17.782Z",
"dateReserved": "2026-06-10T21:38:14.592Z",
"dateUpdated": "2026-07-02T12:15:49.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33592 (GCVE-0-2026-33592)
Vulnerability from cvelistv5 – Published: 2026-07-02 07:12 – Updated: 2026-07-02 12:30
VLAI
EPSS
VEX
Title
FindServers Memory Exhaustion in open62541
Summary
An unauthenticated remote attacker can exhaust
server memory via the FindServers Discovery Service in open62541. The
serverUris field of FindServersRequest is not validated for length or array
size. An attacker can declare an arbitrarily large string (up to ~3.9 GB)
delivered across intermediate chunks without ever sending the final chunk. The
server buffers all chunks in RAM indefinitely until the SecureChannel times
out. The attack is pre-session and bypasses all encryption configuration. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-02 12:29 UTC
CWE
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open62541 project / o6 Automation GmbH | open62541 |
Affected:
1.4.0 , ≤ 1.4.16
(semver)
Affected: 1.5.0 , ≤ 1.5.4 (semver) Affected: master (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33592",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-02T12:29:37.308768Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T12:30:18.800Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "open62541",
"vendor": "open62541 project / o6 Automation GmbH",
"versions": [
{
"lessThanOrEqual": "1.4.16",
"status": "affected",
"version": "1.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.5.4",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "master",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lorenzo Cannella from Fondazione Ugo Bordoni (FUB)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eAn unauthenticated remote attacker can exhaust\nserver memory via the FindServers Discovery Service in open62541. The\nserverUris field of FindServersRequest is not validated for length or array\nsize. An attacker can declare an arbitrarily large string (up to ~3.9 GB)\ndelivered across intermediate chunks without ever sending the final chunk. The\nserver buffers all chunks in RAM indefinitely until the SecureChannel times\nout. The attack is pre-session and bypasses all encryption configuration. The\u0026nbsp;\u003c/span\u003eissue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master."
}
],
"value": "An unauthenticated remote attacker can exhaust\nserver memory via the FindServers Discovery Service in open62541. The\nserverUris field of FindServersRequest is not validated for length or array\nsize. An attacker can declare an arbitrarily large string (up to ~3.9 GB)\ndelivered across intermediate chunks without ever sending the final chunk. The\nserver buffers all chunks in RAM indefinitely until the SecureChannel times\nout. The attack is pre-session and bypasses all encryption configuration. The\u00a0issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of resources without limits or throttling",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory allocation with excessive size value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T07:12:24.250Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/open62541/open62541/pull/8142"
},
{
"tags": [
"patch"
],
"url": "https://github.com/open62541/open62541/pull/8142/changes/d253818d6c5e870e1db0e360b18138c8bdc809ae"
},
{
"tags": [
"product"
],
"url": "https://github.com/open62541/open62541"
}
],
"source": {
"advisory": "SA-2026-0002",
"discovery": "UNKNOWN"
},
"title": "FindServers Memory Exhaustion in open62541",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-33592",
"datePublished": "2026-07-02T07:12:24.250Z",
"dateReserved": "2026-03-23T12:53:47.475Z",
"dateUpdated": "2026-07-02T12:30:18.800Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22313 (GCVE-0-2026-22313)
Vulnerability from cvelistv5 – Published: 2026-06-16 18:36 – Updated: 2026-06-17 15:04
VLAI
EPSS
VEX
Title
OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector
Summary
The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send
arbitrary commands to the device that are executed with administrative permissions by the underlying operating system.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-17 15:03 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cvcn.gov.it/cvcn/cve/CVE-2026-22313 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Radiflow | iSAP Smart Collector |
Affected:
3.07-1
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22313",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-17T15:03:56.405202Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T15:04:07.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSAP Smart Collector",
"vendor": "Radiflow",
"versions": [
{
"status": "affected",
"version": "3.07-1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send\narbitrary commands to the device that are executed with administrative permissions by the underlying operating system."
}
],
"value": "The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send\narbitrary commands to the device that are executed with administrative permissions by the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T18:49:30.740Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2026-22313"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-22313",
"datePublished": "2026-06-16T18:36:41.423Z",
"dateReserved": "2026-01-07T09:31:00.563Z",
"dateUpdated": "2026-06-17T15:04:07.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22312 (GCVE-0-2026-22312)
Vulnerability from cvelistv5 – Published: 2026-06-16 18:19 – Updated: 2026-06-17 12:18
VLAI
EPSS
VEX
Title
Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector
Summary
The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration
and execute some commands (e.g. system reboot).
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-17 12:18 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cvcn.gov.it/cvcn/cve/CVE-2026-22312 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Radiflow | iSAP Smart Collector |
Affected:
3.07-1
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22312",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-17T12:18:32.031146Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T12:18:41.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iSAP Smart Collector",
"vendor": "Radiflow",
"versions": [
{
"status": "affected",
"version": "3.07-1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration\nand execute some commands (e.g. system reboot)."
}
],
"value": "The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration\nand execute some commands (e.g. system reboot)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T18:38:16.344Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2026-22312"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-22312",
"datePublished": "2026-06-16T18:19:33.358Z",
"dateReserved": "2026-01-07T09:31:00.563Z",
"dateUpdated": "2026-06-17T12:18:41.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25600 (GCVE-0-2026-25600)
Vulnerability from cvelistv5 – Published: 2026-06-01 09:37 – Updated: 2026-06-01 13:01
VLAI
EPSS
VEX
Title
Credential Exposure Vulnerability in Trac PDBM
Summary
The PDBM application relies on a static, hard‑coded secret embedded
in the PDBM.exe executable. This secret is used by the application’s
encryption routines, including the function responsible for decrypting
credentials stored in the product’s configuration file. Because the
secret is constant across installations, any attacker with sufficient
local privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored
password and authenticate as the user defined in the configuration file.
In the affected version, this user account is configured with
administrative privileges, granting full access to PDBM’s management
interface and its underlying operational functions.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-01 13:01 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cert.si/en/cve-2026-25600/ | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Trac d.o.o. | PDBM |
Affected:
0 , < 2.0.0.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25600",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T13:01:42.272560Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T13:01:53.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PDBM",
"vendor": "Trac d.o.o.",
"versions": [
{
"lessThan": "2.0.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mijo Mi\u0161i\u0107, Combis d.o.o."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe PDBM application relies on a static, hard\u2011coded secret embedded \nin the PDBM.exe executable. This secret is used by the application\u2019s \nencryption routines, including the function responsible for decrypting \ncredentials stored in the product\u2019s configuration file. Because the \nsecret is constant across installations, any attacker with sufficient \nlocal privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored \npassword and authenticate as the user defined in the configuration file.\n In the affected version, this user account is configured with \nadministrative privileges, granting full access to PDBM\u2019s management \ninterface and its underlying operational functions.\u003c/p\u003e"
}
],
"value": "The PDBM application relies on a static, hard\u2011coded secret embedded \nin the PDBM.exe executable. This secret is used by the application\u2019s \nencryption routines, including the function responsible for decrypting \ncredentials stored in the product\u2019s configuration file. Because the \nsecret is constant across installations, any attacker with sufficient \nlocal privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored \npassword and authenticate as the user defined in the configuration file.\n In the affected version, this user account is configured with \nadministrative privileges, granting full access to PDBM\u2019s management \ninterface and its underlying operational functions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T09:37:48.852Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.cert.si/en/cve-2026-25600/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Credential Exposure Vulnerability in Trac PDBM",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-25600",
"datePublished": "2026-06-01T09:37:48.852Z",
"dateReserved": "2026-02-03T07:24:49.547Z",
"dateUpdated": "2026-06-01T13:01:53.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25599 (GCVE-0-2026-25599)
Vulnerability from cvelistv5 – Published: 2026-06-01 09:17 – Updated: 2026-06-01 13:01 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Missing authentication and clear‑text data transmission affecting Orca heat pumps
Summary
Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices communicating with the Orca server over an
unencrypted and unauthenticated HTTP connection on a non-secure port specifically enable an
attacker to impersonate a legitimate device and inject malicious
payloads. This enables the insertion of harmful code directly
into the Orca user portal, potentially compromising user accounts,
exposing sensitive information, and allowing further unauthorized
actions within the portal.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-01 13:01 UTC
CWE
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Orca Energy | Orca heat pump |
Affected:
0 , < 2.1.0
(semver)
|
|
| Orca Energy | Orca user portal |
Affected:
0 , < 1.19
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25599",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T13:01:12.777564Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T13:01:21.955Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Orca heat pump",
"vendor": "Orca Energy",
"versions": [
{
"lessThan": "2.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Orca user portal",
"vendor": "Orca Energy",
"versions": [
{
"lessThan": "1.19",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tom Kern, NIL d.o.o."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing authentication and clear\u2011text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump\u2019s web control interface.\u0026nbsp;Older Orca heat pump devices communicating with the Orca server over an \nunencrypted and unauthenticated HTTP connection on a non-secure port specifically enable an\n attacker to impersonate a legitimate device and inject malicious \npayloads. This enables the insertion of harmful code directly\n into the Orca user portal, potentially compromising user accounts, \nexposing sensitive information, and allowing further unauthorized \nactions within the portal."
}
],
"value": "Missing authentication and clear\u2011text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump\u2019s web control interface.\u00a0Older Orca heat pump devices communicating with the Orca server over an \nunencrypted and unauthenticated HTTP connection on a non-secure port specifically enable an\n attacker to impersonate a legitimate device and inject malicious \npayloads. This enables the insertion of harmful code directly\n into the Orca user portal, potentially compromising user accounts, \nexposing sensitive information, and allowing further unauthorized \nactions within the portal."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319 Cleartext transmission of sensitive information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T09:17:51.060Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.cert.si/en/cve-2026-25599/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Missing authentication and clear\u2011text data transmission affecting Orca heat pumps",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-25599",
"datePublished": "2026-06-01T09:17:51.060Z",
"dateReserved": "2026-02-03T07:24:49.547Z",
"dateUpdated": "2026-06-01T13:01:21.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33590 (GCVE-0-2026-33590)
Vulnerability from cvelistv5 – Published: 2026-05-28 19:30 – Updated: 2026-06-12 15:02
VLAI
EPSS
VEX
Title
Insecure default permissions in Portainer CE
Summary
Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent
access on the host.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-29 14:57 UTC
CWE
- CWE-276 - Incorrect default permissions
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://intwave.com/blog/2026/02/26/improving-por… | third-party-advisory |
| https://github.com/portainer/portainer/commit/ac8… | issue-tracking |
| https://github.com/portainer/portainer/commit/3e2… | issue-tracking |
| http://www.openwall.com/lists/oss-security/2026/06/12/2 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Portainer | Portainer Community Edition |
Affected:
0 , < 2.39.0
(semver)
Affected: 0 , < 2.38.0 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-29T14:57:42.554840Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-29T14:57:54.101Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-06-12T15:02:52.515Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/06/12/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portainer Community Edition",
"vendor": "Portainer",
"versions": [
{
"lessThan": "2.39.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.38.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent \n\naccess on the host.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent \n\naccess on the host."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect default permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T19:30:06.697Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://intwave.com/blog/2026/02/26/improving-portainer-security.html"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/portainer/portainer/commit/ac8fa7672e732b44b970c9eaf928eddd2c68796c"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/portainer/portainer/commit/3e2fdb1891e81a8e4c5c8beb60e45f07c8ecae52"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insecure default permissions in Portainer CE",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-33590",
"datePublished": "2026-05-28T19:30:06.697Z",
"dateReserved": "2026-03-23T12:53:47.474Z",
"dateUpdated": "2026-06-12T15:02:52.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25602 (GCVE-0-2026-25602)
Vulnerability from cvelistv5 – Published: 2026-05-20 10:54 – Updated: 2026-09-25 14:39
VLAI
EPSS
VEX
Summary
Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client transmits the recipient address of a feedback report to the MEONA Server, and the server sends the report to the transmitted address instead of the address configured on the server. The feedback function is available only in the MEONA administration area, which requires one of the administrative roles ADMINISTRATOR, SUPERADMINISTRATOR or TYPIST (catalogue editing), or the PHARMACIST role holding the PHARMACY_ADMINISTRATOR right, assigned explicitly by the operating hospital's administrators. Such a user who modifies the client request can cause the MEONA Server to send a message with content of the user's choosing, from the sender address configured on the server, to a recipient of the user's choosing, within the limits permitted by the operator's mail relay. The message can be used for social engineering because it appears to originate from an internal hospital system.
Exploitation requires a MEONA account with one of the administrative roles named above and access to the operating hospital's internal network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital's own remote-access infrastructure (e.g. VPN) under the hospital's control. The message contains only the recipient, subject and text entered by the user; no data of other users or patients is disclosed. Mesalvo is not aware of any exploitation outside the reported security test.
This issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 (before 2025.04.24) and 2026.03 (before 2026.03.02). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the server. Operators can restrict at their mail relay which recipients the MEONA sender address may reach.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-20 11:59 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mesalvo.com/en/vdp/advisories/msa-2026-005.pdf | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mesalvo | Meona Server |
Affected:
2024.10
(custom)
Affected: 2025.04 , < 2025.04.24 (custom) Affected: 2026.03 , < 2026.03.02 (custom) |
|
| Mesalvo | Meona Client |
Affected:
2024.10
(custom)
Affected: 2025.04 , < 2025.04.24 (custom) Affected: 2026.03 , < 2026.03.02 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25602",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-20T11:59:55.804011Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T12:00:29.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Meona Server",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"lessThan": "2025.04.24",
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"lessThan": "2026.03.02",
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Meona Client",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"lessThan": "2025.04.24",
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"lessThan": "2026.03.02",
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client transmits the recipient address of a feedback report to the MEONA Server, and the server sends the report to the transmitted address instead of the address configured on the server. The feedback function is available only in the MEONA administration area, which requires one of the administrative roles ADMINISTRATOR, SUPERADMINISTRATOR or TYPIST (catalogue editing), or the PHARMACIST role holding the PHARMACY_ADMINISTRATOR right, assigned explicitly by the operating hospital\u0027s administrators. Such a user who modifies the client request can cause the MEONA Server to send a message with content of the user\u0027s choosing, from the sender address configured on the server, to a recipient of the user\u0027s choosing, within the limits permitted by the operator\u0027s\u0026nbsp;mail relay. The message can be used for social engineering because it appears to originate from an internal hospital system.\u003cbr\u003eExploitation requires a MEONA account with one of the administrative roles named above and access to the operating hospital\u0027s internal network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control. The message contains only the recipient, subject and text entered by the user; no data of other users or patients is disclosed. Mesalvo is not aware of any exploitation outside the reported security test.\u003cbr\u003eThis issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 (before 2025.04.24) and 2026.03 (before 2026.03.02). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the server. Operators can restrict at their mail relay which recipients the MEONA sender address may reach."
}
],
"value": "Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client transmits the recipient address of a feedback report to the MEONA Server, and the server sends the report to the transmitted address instead of the address configured on the server. The feedback function is available only in the MEONA administration area, which requires one of the administrative roles ADMINISTRATOR, SUPERADMINISTRATOR or TYPIST (catalogue editing), or the PHARMACIST role holding the PHARMACY_ADMINISTRATOR right, assigned explicitly by the operating hospital\u0027s administrators. Such a user who modifies the client request can cause the MEONA Server to send a message with content of the user\u0027s choosing, from the sender address configured on the server, to a recipient of the user\u0027s choosing, within the limits permitted by the operator\u0027s\u00a0mail relay. The message can be used for social engineering because it appears to originate from an internal hospital system.\nExploitation requires a MEONA account with one of the administrative roles named above and access to the operating hospital\u0027s internal network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control. The message contains only the recipient, subject and text entered by the user; no data of other users or patients is disclosed. Mesalvo is not aware of any exploitation outside the reported security test.\nThis issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 (before 2025.04.24) and 2026.03 (before 2026.03.02). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the server. Operators can restrict at their mail relay which recipients the MEONA sender address may reach."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:39:41.572Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://mesalvo.com/en/vdp/advisories/msa-2026-005.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the MEONA Server and ignore any client-supplied recipient."
}
],
"value": "MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the MEONA Server and ignore any client-supplied recipient."
}
],
"source": {
"discovery": "UNKNOWN"
},
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Operators can restrict, at their mail relay, the recipients that the MEONA sender address (e.g. noreply-meona-\u2026) may reach to the configured feedback mailbox, or to internal domains, and monitor messages from that sender address to other recipients. Details: Mesalvo Security Advisory MSA-2026-005."
}
],
"value": "Operators can restrict, at their mail relay, the recipients that the MEONA sender address (e.g. noreply-meona-\u2026) may reach to the configured feedback mailbox, or to internal domains, and monitor messages from that sender address to other recipients. Details: Mesalvo Security Advisory MSA-2026-005."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-25602",
"datePublished": "2026-05-20T10:54:13.448Z",
"dateReserved": "2026-02-03T07:24:49.548Z",
"dateUpdated": "2026-09-25T14:39:41.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0857 (GCVE-0-2026-0857)
Vulnerability from cvelistv5 – Published: 2026-05-20 10:50 – Updated: 2026-09-25 14:23
VLAI
EPSS
VEX
Summary
Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose password was last set under a version before MEONA 2024.10. MEONA versions before 2024.10 protected stored passwords with SHA-1 (versions from October 2015) or stored them without protection (earlier versions). Since MEONA 2024.10 (June 2024) Argon2 is the default method and every password that is set or changed is stored with Argon2; passwords last set under an earlier version keep the earlier method until they are changed. An administrator could in addition select the storage method per account. A MEONA super administrator can read the stored value of such accounts in the user administration of the MEONA Client or export it through administrative database functions. Only accounts managed locally in MEONA are affected; accounts authenticated through the operating hospital's directory service (Active Directory / Entra ID) have no password stored in MEONA. In typical installations end users authenticate through the directory service and local accounts are limited to emergency and technical accounts.
Exploitation requires super administrator permissions in MEONA (or direct access to the MEONA database) from within the operating hospital's network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital's own remote-access infrastructure (e.g. VPN) under the hospital's control. Installations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Mesalvo is not aware of any exploitation outside the reported security test.
This issue affects MEONA Server and MEONA Client in versions 2024.10, 2025.04 and 2026.03 (for accounts with passwords last set under earlier versions). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) remove the legacy storage methods, require every affected account to set a new Argon2-protected password at next logon, and no longer display stored credential values in the user administration. See Mesalvo Security Advisory MSA-2026-002.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-20 12:01 UTC
CWE
- CWE-916 - Use of password hash with insufficient computational effort
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mesalvo.com/en/vdp/advisories/msa-2026-002.pdf | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mesalvo | Meona Client |
Affected:
2024.10
(custom)
Affected: 2025.04 , < 2025.04.24 (custom) Affected: 2026.03 , < 2026.03.02 (custom) |
|
| Mesalvo | Meona Server |
Affected:
2024.10
(custom)
Affected: 2025.04 , < 2025.04.24 (custom) Affected: 2026.03 , < 2026.03.02 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0857",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-20T12:01:24.904395Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T12:01:48.193Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Meona Client",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"lessThan": "2025.04.24",
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"lessThan": "2026.03.02",
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Meona Server",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"lessThan": "2025.04.24",
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"lessThan": "2026.03.02",
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose password was last set under a version before MEONA 2024.10. MEONA versions before 2024.10 protected stored passwords with SHA-1 (versions from October\u0026nbsp;2015) or stored them without protection (earlier versions). Since MEONA 2024.10 (June 2024) Argon2 is the default method and every password that is set or changed is stored with Argon2; passwords last set under an earlier version keep the earlier method until they are changed. An administrator could in addition select the storage method per account. A MEONA super administrator can read the stored value of such accounts in the user administration of the MEONA Client or export it through administrative database functions. Only accounts managed locally in MEONA are affected; accounts authenticated through the operating hospital\u0027s directory service (Active Directory / Entra ID) have no password stored in MEONA. In typical installations end users authenticate through the directory service and local accounts are limited to emergency and technical accounts.\u003cbr\u003eExploitation requires super administrator permissions in MEONA (or direct access to the MEONA database) from within the operating hospital\u0027s network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control. Installations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Mesalvo is not aware of any exploitation outside the reported security test.\u003cbr\u003eThis issue affects MEONA Server and MEONA Client in versions 2024.10, 2025.04 and 2026.03 (for accounts with passwords last set under earlier versions). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) remove the legacy storage methods, require every affected account to set a new Argon2-protected password at next logon, and no longer display stored credential values in the user administration. See Mesalvo Security Advisory MSA-2026-002."
}
],
"value": "Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose password was last set under a version before MEONA 2024.10. MEONA versions before 2024.10 protected stored passwords with SHA-1 (versions from October\u00a02015) or stored them without protection (earlier versions). Since MEONA 2024.10 (June 2024) Argon2 is the default method and every password that is set or changed is stored with Argon2; passwords last set under an earlier version keep the earlier method until they are changed. An administrator could in addition select the storage method per account. A MEONA super administrator can read the stored value of such accounts in the user administration of the MEONA Client or export it through administrative database functions. Only accounts managed locally in MEONA are affected; accounts authenticated through the operating hospital\u0027s directory service (Active Directory / Entra ID) have no password stored in MEONA. In typical installations end users authenticate through the directory service and local accounts are limited to emergency and technical accounts.\nExploitation requires super administrator permissions in MEONA (or direct access to the MEONA database) from within the operating hospital\u0027s network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control. Installations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Mesalvo is not aware of any exploitation outside the reported security test.\nThis issue affects MEONA Server and MEONA Client in versions 2024.10, 2025.04 and 2026.03 (for accounts with passwords last set under earlier versions). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) remove the legacy storage methods, require every affected account to set a new Argon2-protected password at next logon, and no longer display stored credential values in the user administration. See Mesalvo Security Advisory MSA-2026-002."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-916",
"description": "CWE-916 Use of password hash with insufficient computational effort",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:23:59.996Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://mesalvo.com/en/vdp/advisories/msa-2026-002.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MEONA 2025.04.24 and 2026.03.02 (Q4 2026) remove the legacy password storage methods, require every account whose password is still stored with a legacy method to set a new Argon2-protected password at next logon, and remove the display of stored credential values from the user administration."
}
],
"value": "MEONA 2025.04.24 and 2026.03.02 (Q4 2026) remove the legacy password storage methods, require every account whose password is still stored with a legacy method to set a new Argon2-protected password at next logon, and remove the display of stored credential values from the user administration."
}
],
"source": {
"discovery": "UNKNOWN"
},
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until the service packs are installed, administrators can force a password change for accounts whose password was last set under a version before MEONA 2024.10; the new password is stored with Argon2.\u0026nbsp;\u003cbr\u003e\u003cbr\u003eInstallations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Details: Mesalvo Security Advisory MSA-2026-002."
}
],
"value": "Until the service packs are installed, administrators can force a password change for accounts whose password was last set under a version before MEONA 2024.10; the new password is stored with Argon2.\u00a0\n\nInstallations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Details: Mesalvo Security Advisory MSA-2026-002."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-0857",
"datePublished": "2026-05-20T10:50:58.695Z",
"dateReserved": "2026-01-12T06:14:14.665Z",
"dateUpdated": "2026-09-25T14:23:59.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22315 (GCVE-0-2026-22315)
Vulnerability from cvelistv5 – Published: 2026-05-20 10:46 – Updated: 2026-09-25 14:11
VLAI
EPSS
VEX
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-09-25T14:11:13.577Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"rejectedReasons": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
],
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-22315",
"datePublished": "2026-05-20T10:46:51.995Z",
"dateRejected": "2026-09-25T14:11:13.577Z",
"dateReserved": "2026-01-07T09:31:00.563Z",
"dateUpdated": "2026-09-25T14:11:13.577Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0856 (GCVE-0-2026-0856)
Vulnerability from cvelistv5 – Published: 2026-05-20 10:38 – Updated: 2026-09-25 15:44
VLAI
EPSS
VEX
Summary
Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administrative functions of the MEONA Client (admin panel). The MEONA Server does not independently verify the role asserted by the MEONA Client. A user who holds a valid MEONA user account and is able to execute a modified copy of the MEONA Client on a device within the operating hospital's network can assert an administrator role and access administrative functions with regular user credentials.
Exploitation requires: (1) a valid MEONA user account issued by the operating hospital; (2) network access to the MEONA Server, which is operated exclusively within closed hospital networks without exposure to the public Internet (where a hospital permits remote access to that network at all, it is only through the hospital's own remote-access infrastructure (e.g. VPN) under the hospital's control); (3) the ability to modify MEONA Client binaries and to execute the modified copy on a device in that network. On managed devices with application control, as recommended in Mesalvo's hardening guidance (MSA-2026-001), this requires local administrator privileges on the device. Mesalvo is not aware of any exploitation outside the reported security test.
This issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 and 2026.03. Mitigations are available with MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026); see Mesalvo Security Advisory MSA-2026-001.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-20 12:27 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mesalvo.com/en/vdp/advisories/msa-2026-001.pdf | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mesalvo | Meona Client |
Affected:
2024.10
(custom)
Affected: 2025.04 (custom) Affected: 2026.03 (custom) |
|
| Mesalvo | Meona Server |
Affected:
2024.10
(custom)
Affected: 2025.04 (custom) Affected: 2026.03 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0856",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-20T12:27:02.745163Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T12:27:12.637Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Meona Client",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Meona Server",
"vendor": "Mesalvo",
"versions": [
{
"status": "affected",
"version": "2024.10",
"versionType": "custom"
},
{
"status": "affected",
"version": "2025.04",
"versionType": "custom"
},
{
"status": "affected",
"version": "2026.03",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administrative functions of the MEONA Client (admin panel). The MEONA Server does not independently verify the role asserted by the MEONA Client. A user who holds a valid MEONA user account and is able to execute a modified copy of the MEONA Client on a device within the operating hospital\u0027s network can assert an administrator role and access administrative functions with regular user credentials.\u003cbr\u003eExploitation requires: (1) a valid MEONA user account issued by the operating hospital; (2) network access to the MEONA Server, which is operated exclusively within closed hospital networks without exposure to the public Internet (where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control); (3) the ability to modify MEONA Client binaries and to execute the modified copy on a device in that network. On managed devices with application control, as recommended in Mesalvo\u0027s hardening guidance (MSA-2026-001), this requires local administrator privileges on the device. Mesalvo is not aware of any exploitation outside the reported security test.\u003cbr\u003eThis issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 and 2026.03. Mitigations are available with MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026); see Mesalvo Security Advisory MSA-2026-001."
}
],
"value": "Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administrative functions of the MEONA Client (admin panel). The MEONA Server does not independently verify the role asserted by the MEONA Client. A user who holds a valid MEONA user account and is able to execute a modified copy of the MEONA Client on a device within the operating hospital\u0027s network can assert an administrator role and access administrative functions with regular user credentials.\nExploitation requires: (1) a valid MEONA user account issued by the operating hospital; (2) network access to the MEONA Server, which is operated exclusively within closed hospital networks without exposure to the public Internet (where a hospital permits remote access to that network at all, it is only through the hospital\u0027s own remote-access infrastructure (e.g. VPN) under the hospital\u0027s control); (3) the ability to modify MEONA Client binaries and to execute the modified copy on a device in that network. On managed devices with application control, as recommended in Mesalvo\u0027s hardening guidance (MSA-2026-001), this requires local administrator privileges on the device. Mesalvo is not aware of any exploitation outside the reported security test.\nThis issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 and 2026.03. Mitigations are available with MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026); see Mesalvo Security Advisory MSA-2026-001."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T15:44:21.119Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://mesalvo.com/en/vdp/advisories/msa-2026-001.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MEONA 2025.04.24 and 2026.03.02 (Q4 2026) introduce code signing of all MEONA Client executables and assemblies and integrity verification of the client assemblies at start-up. Operators should enforce application control on MEONA workstations so that only Mesalvo-signed binaries execute, withhold local administrator rights from clinical users, provision MEONA users through the hospital\u0027s central identity and access management, and keep the MEONA network zone segmented without Internet exposure. Details: Mesalvo Security Advisory MSA-2026-001."
}
],
"value": "MEONA 2025.04.24 and 2026.03.02 (Q4 2026) introduce code signing of all MEONA Client executables and assemblies and integrity verification of the client assemblies at start-up. Operators should enforce application control on MEONA workstations so that only Mesalvo-signed binaries execute, withhold local administrator rights from clinical users, provision MEONA users through the hospital\u0027s central identity and access management, and keep the MEONA network zone segmented without Internet exposure. Details: Mesalvo Security Advisory MSA-2026-001."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-0856",
"datePublished": "2026-05-20T10:38:53.881Z",
"dateReserved": "2026-01-12T06:14:09.204Z",
"dateUpdated": "2026-09-25T15:44:21.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22314 (GCVE-0-2026-22314)
Vulnerability from cvelistv5 – Published: 2026-05-20 10:29 – Updated: 2026-09-25 14:02 Disputed
VLAI
EPSS
VEX
Summary
Improper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users' systems. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020.
Severity
7.9 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-20 12:29 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mesalvo.com/en/vdp/advisories/msa-2026-003.pdf | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mesalvo | Meona Client Launcher Component |
Affected:
0 , ≤ 19.06.2020 15:11:49
(custom)
|
|
| Mesalvo | Meona Server Component |
Affected:
0 , ≤ 2025.04 5+323020
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22314",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-20T12:29:31.474390Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-20T12:34:04.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Meona Client Launcher Component",
"vendor": "Mesalvo",
"versions": [
{
"lessThanOrEqual": "19.06.2020 15:11:49",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Meona Server Component",
"vendor": "Mesalvo",
"versions": [
{
"lessThanOrEqual": "2025.04 5+323020",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users\u0027 systems.\u0026nbsp;This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020."
}
],
"value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users\u0027 systems.\u00a0This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:02:42.115Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://mesalvo.com/en/vdp/advisories/msa-2026-003.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"disputed"
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-22314",
"datePublished": "2026-05-20T10:29:38.661Z",
"dateReserved": "2026-01-07T09:31:00.563Z",
"dateUpdated": "2026-09-25T14:02:42.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33585 (GCVE-0-2026-33585)
Vulnerability from cvelistv5 – Published: 2026-05-13 18:46 – Updated: 2026-05-13 19:31
VLAI
EPSS
VEX
Title
Arqit SKA-Platform Improper Handling of Parameters Vulnerability
Summary
Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenant user via an unexpired browser session.
This issue affects Symmetric Key Agreement Platform: before 26.03.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 19:28 UTC
CWE
- CWE-233 - Improper handling of parameters
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cvcn.gov.it/cvcn/cve/CVE-2026-33585 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arqit | Symmetric Key Agreement Platform |
Affected:
0 , < 26.03
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33585",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T19:28:17.084847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T19:31:17.058Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Symmetric Key Agreement Platform",
"vendor": "Arqit",
"versions": [
{
"lessThan": "26.03",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper management of the idle timeout parameter\u0026nbsp;in the Keycloak interface of\u0026nbsp;the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenant user via an unexpired browser session.\n\n\u003cp\u003eThis issue affects Symmetric Key Agreement Platform: before 26.03.\u003c/p\u003e"
}
],
"value": "Improper management of the idle timeout parameter\u00a0in the Keycloak interface of\u00a0the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenant user via an unexpired browser session.\n\n\n\nThis issue affects Symmetric Key Agreement Platform: before 26.03."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "PHYSICAL",
"availabilityImpact": "LOW",
"baseScore": 3.8,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-233",
"description": "CWE-233 Improper handling of parameters",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T18:46:13.920Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2026-33585"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Arqit SKA-Platform Improper Handling of Parameters Vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-33585",
"datePublished": "2026-05-13T18:46:13.920Z",
"dateReserved": "2026-03-23T12:53:47.473Z",
"dateUpdated": "2026-05-13T19:31:17.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33584 (GCVE-0-2026-33584)
Vulnerability from cvelistv5 – Published: 2026-05-13 18:30 – Updated: 2026-05-13 19:39
VLAI
EPSS
VEX
Title
Arqit SKA-Platform Enables Access to Debug Information
Summary
Exposed Keycloak management
service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug
information such as metrics and
health data. This issue affects Symmetric Key Agreement Platform: before 26.03.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 19:37 UTC
CWE
- CWE-749 - Exposed dangerous method or function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cvcn.gov.it/cvcn/cve/CVE-2026-33584 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arqit | Symmetric Key Agreement Platform |
Affected:
0 , < 26.03
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33584",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T19:37:59.672987Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T19:39:01.096Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Symmetric Key Agreement Platform",
"vendor": "Arqit",
"versions": [
{
"lessThan": "26.03",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Exposed Keycloak management \nservice in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug \ninformation such as metrics and\n health data.\u0026nbsp;This issue affects Symmetric Key Agreement Platform: before 26.03."
}
],
"value": "Exposed Keycloak management \nservice in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug \ninformation such as metrics and\n health data.\u00a0This issue affects Symmetric Key Agreement Platform: before 26.03."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749 Exposed dangerous method or function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T18:35:29.330Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2026-33584"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Arqit SKA-Platform Enables Access to Debug Information",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-33584",
"datePublished": "2026-05-13T18:30:48.206Z",
"dateReserved": "2026-03-23T12:53:47.473Z",
"dateUpdated": "2026-05-13T19:39:01.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33583 (GCVE-0-2026-33583)
Vulnerability from cvelistv5 – Published: 2026-05-13 18:19 – Updated: 2026-05-13 18:57
VLAI
EPSS
VEX
Title
Arqit SKA-Platform Vulnerable to Key Exposure
Summary
Exposure of the QKEY (used as
input into the ‘OTA-Quantum’ device registration process) and internal
system keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform.
This issue affects Symmetric Key Agreement Platform: before 26.03.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 18:57 UTC
CWE
- CWE-749 - Exposed dangerous method or function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cvcn.gov.it/cvcn/cve/CVE-2026-33583 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arqit | Symmetric Key Agreement Platform |
Affected:
0 , < 26.03
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33583",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T18:57:23.168695Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T18:57:55.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Symmetric Key Agreement Platform",
"vendor": "Arqit",
"versions": [
{
"lessThan": "26.03",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Exposure of the QKEY (used as \ninput into the \u2018OTA-Quantum\u2019 device registration process) and internal \nsystem keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform.\u003cp\u003eThis issue affects Symmetric Key Agreement Platform: before 26.03.\u003c/p\u003e"
}
],
"value": "Exposure of the QKEY (used as \ninput into the \u2018OTA-Quantum\u2019 device registration process) and internal \nsystem keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform.\n\nThis issue affects Symmetric Key Agreement Platform: before 26.03."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749 Exposed dangerous method or function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T18:19:34.651Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2026-33583"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Arqit SKA-Platform Vulnerable to Key Exposure",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-33583",
"datePublished": "2026-05-13T18:19:34.651Z",
"dateReserved": "2026-03-23T12:53:47.473Z",
"dateUpdated": "2026-05-13T18:57:55.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}