Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
12 vulnerabilities by tbc
CVE-2026-89309 (GCVE-0-2026-89309)
Vulnerability from nvd – Published: 2026-10-13 08:38 – Updated: 2026-10-14 06:48
VLAI
EPSS
VEX
Title
Missing Authentication Vulnerability in JTL-WMS
Summary
The authorization middleware of the WMS MobileServer
fails to require authentication in two distinct cases. First, it
only requires an Authorization header for GET and HEAD requests; requests
using any other HTTP method are processed without an authentication check.
Second, for any HTTP method including GET and HEAD, a request carrying a
malformed or non-bearer Authorization header is passed through without
a valid token being required.
The middleware does validate a token whenever a
well-formed one is present, but in these two cases it does not
require one. A remote attacker with network access to the service can
therefore invoke API functionality without valid credentials.
Severity
10 (Critical)
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.jtl-software.com/de/cve-2026-89309-cv… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| JTL SW GmbH | JTL-WMS |
Affected:
0 , < 2.0.7
(semver)
Affected: 0 , < 2.1.2 (semver) Affected: 0 , < 2.2.1 (semver) Affected: 1.7.*, 1.8.*, 1.9.*, 1.10.*, 1.11.* (semver) |
Date Public
2026-10-13 14:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "JTL-WMS",
"vendor": "JTL SW GmbH",
"versions": [
{
"lessThan": "2.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.1.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.7.*, 1.8.*, 1.9.*, 1.10.*, 1.11.*",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-13T14:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe authorization middleware of the WMS MobileServer\nfails to require authentication in two distinct cases. First, it\nonly requires an Authorization header for GET and HEAD requests; requests\nusing any other HTTP method are processed without an authentication check.\nSecond, for any HTTP method including GET and HEAD, a request carrying a\nmalformed or non-bearer Authorization header is passed through without\na valid token being required.\u003c/p\u003e\n\n\u003cp\u003eThe middleware does validate a token whenever a\nwell-formed one is present, but in these two cases it does not\nrequire one. A remote attacker with network access to the service can\ntherefore invoke API functionality without valid credentials.\u003c/p\u003e\n\n\n\n\n\n\u003cbr\u003e"
}
],
"value": "The authorization middleware of the WMS MobileServer\nfails to require authentication in two distinct cases. First, it\nonly requires an Authorization header for GET and HEAD requests; requests\nusing any other HTTP method are processed without an authentication check.\nSecond, for any HTTP method including GET and HEAD, a request carrying a\nmalformed or non-bearer Authorization header is passed through without\na valid token being required.\n\n\n\n\n\nThe middleware does validate a token whenever a\nwell-formed one is present, but in these two cases it does not\nrequire one. A remote attacker with network access to the service can\ntherefore invoke API functionality without valid credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T06:48:53.187Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.jtl-software.com/de/cve-2026-89309-cve-2026-89310"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Missing Authentication Vulnerability in JTL-WMS",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-89309",
"datePublished": "2026-10-13T08:38:59.289Z",
"dateReserved": "2026-09-11T13:54:43.619Z",
"dateUpdated": "2026-10-14T06:48:53.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43833 (GCVE-0-2026-43833)
Vulnerability from nvd – Published: 2026-07-31 03:04 – Updated: 2026-09-11 13:09
VLAI
EPSS
VEX
Title
tbc
Summary
Full details and mitigation steps are currently restricted and will be published at a later date.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 17:10 UTC
Assigner
References
Date Public
2026-07-31 03:01
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-43833",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T17:10:01.210806Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T17:10:15.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-11T13:09:30.123Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://github.com/CVEProject/cvelistV5/blob/8846a06bd73fefb0d7b7e205f1e21f97d0b9cbe2/cves/2026/43xxx/CVE-2026-43833.json"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "tbc",
"vendor": "tbc",
"versions": [
{
"status": "affected",
"version": "tbc"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "tbc"
},
{
"lang": "en",
"type": "finder",
"value": "tbc1"
}
],
"datePublic": "2026-07-31T03:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T05:27:16.736Z",
"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"shortName": "CSA"
},
"references": [
{
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-xxx"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "tbc",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"assignerShortName": "CSA",
"cveId": "CVE-2026-43833",
"datePublished": "2026-07-31T03:04:02.005Z",
"dateReserved": "2026-05-04T03:13:26.242Z",
"dateUpdated": "2026-09-11T13:09:30.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43832 (GCVE-0-2026-43832)
Vulnerability from nvd – Published: 2026-07-31 03:00 – Updated: 2026-09-11 13:08
VLAI
EPSS
VEX
Title
tbc
Summary
Full details and mitigation steps are currently restricted and will be published at a later date.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-31 20:01 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
Date Public
2026-07-31 02:58
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-43832",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T20:01:58.635232Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T20:02:04.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-11T13:08:56.635Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://github.com/CVEProject/cvelistV5/blob/8846a06bd73fefb0d7b7e205f1e21f97d0b9cbe2/cves/2026/43xxx/CVE-2026-43832.json"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "tbc",
"vendor": "tbc",
"versions": [
{
"status": "affected",
"version": "tbc"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "tbc"
},
{
"lang": "en",
"type": "finder",
"value": "tbc1"
}
],
"datePublic": "2026-07-31T02:58:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eFull details and mitigation steps are currently restricted and will be published at a later date.\u003c/p\u003e"
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T05:22:09.897Z",
"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"shortName": "CSA"
},
"references": [
{
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-xxx"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "tbc",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"assignerShortName": "CSA",
"cveId": "CVE-2026-43832",
"datePublished": "2026-07-31T03:00:49.264Z",
"dateReserved": "2026-05-04T03:13:26.242Z",
"dateUpdated": "2026-09-11T13:08:56.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43831 (GCVE-0-2026-43831)
Vulnerability from nvd – Published: 2026-07-31 02:57 – Updated: 2026-09-11 13:08
VLAI
EPSS
VEX
Title
tbc
Summary
Full details and mitigation steps are currently restricted and will be published at a later date.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-31 19:56 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
Date Public
2026-07-31 02:54
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-43831",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T19:56:37.918855Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:57:05.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-11T13:08:20.071Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://github.com/CVEProject/cvelistV5/blob/8846a06bd73fefb0d7b7e205f1e21f97d0b9cbe2/cves/2026/43xxx/CVE-2026-43831.json"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "tbc",
"vendor": "tbc",
"versions": [
{
"status": "affected",
"version": "tbc"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "tbc"
},
{
"lang": "en",
"type": "finder",
"value": "tbc1"
}
],
"datePublic": "2026-07-31T02:54:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T05:20:56.722Z",
"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"shortName": "CSA"
},
"references": [
{
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-xxx"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "tbc",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"assignerShortName": "CSA",
"cveId": "CVE-2026-43831",
"datePublished": "2026-07-31T02:57:11.653Z",
"dateReserved": "2026-05-04T03:13:26.241Z",
"dateUpdated": "2026-09-11T13:08:20.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43830 (GCVE-0-2026-43830)
Vulnerability from nvd – Published: 2026-07-31 02:53 – Updated: 2026-09-11 13:07
VLAI
EPSS
VEX
Title
tbc
Summary
Full details and mitigation steps are currently restricted and will be published at a later date.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-31 19:51 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Date Public
2026-07-31 02:49
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-43830",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T19:51:07.430876Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:52:41.957Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-11T13:07:40.371Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://github.com/CVEProject/cvelistV5/blob/8846a06bd73fefb0d7b7e205f1e21f97d0b9cbe2/cves/2026/43xxx/CVE-2026-43830.json"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "tbc",
"vendor": "tbc",
"versions": [
{
"status": "affected",
"version": "tbc"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "tbc"
},
{
"lang": "en",
"type": "finder",
"value": "tbc1"
}
],
"datePublic": "2026-07-31T02:49:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eFull details and mitigation steps are currently restricted and will be published at a later date.\u003c/p\u003e"
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T05:20:00.541Z",
"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"shortName": "CSA"
},
"references": [
{
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-xxx"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "tbc",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"assignerShortName": "CSA",
"cveId": "CVE-2026-43830",
"datePublished": "2026-07-31T02:53:27.625Z",
"dateReserved": "2026-05-04T03:13:26.241Z",
"dateUpdated": "2026-09-11T13:07:40.371Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43829 (GCVE-0-2026-43829)
Vulnerability from nvd – Published: 2026-07-31 02:48 – Updated: 2026-09-11 13:06
VLAI
EPSS
VEX
Title
tbc
Summary
Full details and mitigation steps are currently restricted and will be published at a later date.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-31 19:47 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
Date Public
2026-07-31 02:41
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-43829",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T19:47:40.588661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:48:20.994Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-11T13:06:41.671Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://github.com/CVEProject/cvelistV5/blob/8846a06bd73fefb0d7b7e205f1e21f97d0b9cbe2/cves/2026/43xxx/CVE-2026-43829.json"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "tbc",
"vendor": "tbc",
"versions": [
{
"status": "affected",
"version": "tbc"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "tbc"
},
{
"lang": "en",
"type": "finder",
"value": "tbc1"
}
],
"datePublic": "2026-07-31T02:41:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T05:18:51.668Z",
"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"shortName": "CSA"
},
"references": [
{
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-xxx"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Advantech,\nthe product owner, has rolled out fixes for all reported vulnerabilities. Users\nand administrators of affected product versions are advised to update to the\nlatest version."
}
],
"value": "Advantech,\nthe product owner, has rolled out fixes for all reported vulnerabilities. Users\nand administrators of affected product versions are advised to update to the\nlatest version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "tbc",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"assignerShortName": "CSA",
"cveId": "CVE-2026-43829",
"datePublished": "2026-07-31T02:48:23.886Z",
"dateReserved": "2026-05-04T03:13:26.241Z",
"dateUpdated": "2026-09-11T13:06:41.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89309 (GCVE-0-2026-89309)
Vulnerability from cvelistv5 – Published: 2026-10-13 08:38 – Updated: 2026-10-14 06:48
VLAI
EPSS
VEX
Title
Missing Authentication Vulnerability in JTL-WMS
Summary
The authorization middleware of the WMS MobileServer
fails to require authentication in two distinct cases. First, it
only requires an Authorization header for GET and HEAD requests; requests
using any other HTTP method are processed without an authentication check.
Second, for any HTTP method including GET and HEAD, a request carrying a
malformed or non-bearer Authorization header is passed through without
a valid token being required.
The middleware does validate a token whenever a
well-formed one is present, but in these two cases it does not
require one. A remote attacker with network access to the service can
therefore invoke API functionality without valid credentials.
Severity
10 (Critical)
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.jtl-software.com/de/cve-2026-89309-cv… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| JTL SW GmbH | JTL-WMS |
Affected:
0 , < 2.0.7
(semver)
Affected: 0 , < 2.1.2 (semver) Affected: 0 , < 2.2.1 (semver) Affected: 1.7.*, 1.8.*, 1.9.*, 1.10.*, 1.11.* (semver) |
Date Public
2026-10-13 14:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "JTL-WMS",
"vendor": "JTL SW GmbH",
"versions": [
{
"lessThan": "2.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.1.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.7.*, 1.8.*, 1.9.*, 1.10.*, 1.11.*",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-13T14:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe authorization middleware of the WMS MobileServer\nfails to require authentication in two distinct cases. First, it\nonly requires an Authorization header for GET and HEAD requests; requests\nusing any other HTTP method are processed without an authentication check.\nSecond, for any HTTP method including GET and HEAD, a request carrying a\nmalformed or non-bearer Authorization header is passed through without\na valid token being required.\u003c/p\u003e\n\n\u003cp\u003eThe middleware does validate a token whenever a\nwell-formed one is present, but in these two cases it does not\nrequire one. A remote attacker with network access to the service can\ntherefore invoke API functionality without valid credentials.\u003c/p\u003e\n\n\n\n\n\n\u003cbr\u003e"
}
],
"value": "The authorization middleware of the WMS MobileServer\nfails to require authentication in two distinct cases. First, it\nonly requires an Authorization header for GET and HEAD requests; requests\nusing any other HTTP method are processed without an authentication check.\nSecond, for any HTTP method including GET and HEAD, a request carrying a\nmalformed or non-bearer Authorization header is passed through without\na valid token being required.\n\n\n\n\n\nThe middleware does validate a token whenever a\nwell-formed one is present, but in these two cases it does not\nrequire one. A remote attacker with network access to the service can\ntherefore invoke API functionality without valid credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T06:48:53.187Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.jtl-software.com/de/cve-2026-89309-cve-2026-89310"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Missing Authentication Vulnerability in JTL-WMS",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-89309",
"datePublished": "2026-10-13T08:38:59.289Z",
"dateReserved": "2026-09-11T13:54:43.619Z",
"dateUpdated": "2026-10-14T06:48:53.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43833 (GCVE-0-2026-43833)
Vulnerability from cvelistv5 – Published: 2026-07-31 03:04 – Updated: 2026-09-11 13:09
VLAI
EPSS
VEX
Title
tbc
Summary
Full details and mitigation steps are currently restricted and will be published at a later date.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 17:10 UTC
Assigner
References
Date Public
2026-07-31 03:01
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-43833",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T17:10:01.210806Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T17:10:15.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-11T13:09:30.123Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://github.com/CVEProject/cvelistV5/blob/8846a06bd73fefb0d7b7e205f1e21f97d0b9cbe2/cves/2026/43xxx/CVE-2026-43833.json"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "tbc",
"vendor": "tbc",
"versions": [
{
"status": "affected",
"version": "tbc"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "tbc"
},
{
"lang": "en",
"type": "finder",
"value": "tbc1"
}
],
"datePublic": "2026-07-31T03:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T05:27:16.736Z",
"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"shortName": "CSA"
},
"references": [
{
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-xxx"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "tbc",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"assignerShortName": "CSA",
"cveId": "CVE-2026-43833",
"datePublished": "2026-07-31T03:04:02.005Z",
"dateReserved": "2026-05-04T03:13:26.242Z",
"dateUpdated": "2026-09-11T13:09:30.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43832 (GCVE-0-2026-43832)
Vulnerability from cvelistv5 – Published: 2026-07-31 03:00 – Updated: 2026-09-11 13:08
VLAI
EPSS
VEX
Title
tbc
Summary
Full details and mitigation steps are currently restricted and will be published at a later date.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-31 20:01 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
Date Public
2026-07-31 02:58
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-43832",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T20:01:58.635232Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T20:02:04.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-11T13:08:56.635Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://github.com/CVEProject/cvelistV5/blob/8846a06bd73fefb0d7b7e205f1e21f97d0b9cbe2/cves/2026/43xxx/CVE-2026-43832.json"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "tbc",
"vendor": "tbc",
"versions": [
{
"status": "affected",
"version": "tbc"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "tbc"
},
{
"lang": "en",
"type": "finder",
"value": "tbc1"
}
],
"datePublic": "2026-07-31T02:58:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eFull details and mitigation steps are currently restricted and will be published at a later date.\u003c/p\u003e"
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T05:22:09.897Z",
"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"shortName": "CSA"
},
"references": [
{
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-xxx"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "tbc",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"assignerShortName": "CSA",
"cveId": "CVE-2026-43832",
"datePublished": "2026-07-31T03:00:49.264Z",
"dateReserved": "2026-05-04T03:13:26.242Z",
"dateUpdated": "2026-09-11T13:08:56.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43831 (GCVE-0-2026-43831)
Vulnerability from cvelistv5 – Published: 2026-07-31 02:57 – Updated: 2026-09-11 13:08
VLAI
EPSS
VEX
Title
tbc
Summary
Full details and mitigation steps are currently restricted and will be published at a later date.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-31 19:56 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
Date Public
2026-07-31 02:54
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-43831",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T19:56:37.918855Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:57:05.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-11T13:08:20.071Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://github.com/CVEProject/cvelistV5/blob/8846a06bd73fefb0d7b7e205f1e21f97d0b9cbe2/cves/2026/43xxx/CVE-2026-43831.json"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "tbc",
"vendor": "tbc",
"versions": [
{
"status": "affected",
"version": "tbc"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "tbc"
},
{
"lang": "en",
"type": "finder",
"value": "tbc1"
}
],
"datePublic": "2026-07-31T02:54:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T05:20:56.722Z",
"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"shortName": "CSA"
},
"references": [
{
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-xxx"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "tbc",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"assignerShortName": "CSA",
"cveId": "CVE-2026-43831",
"datePublished": "2026-07-31T02:57:11.653Z",
"dateReserved": "2026-05-04T03:13:26.241Z",
"dateUpdated": "2026-09-11T13:08:20.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43830 (GCVE-0-2026-43830)
Vulnerability from cvelistv5 – Published: 2026-07-31 02:53 – Updated: 2026-09-11 13:07
VLAI
EPSS
VEX
Title
tbc
Summary
Full details and mitigation steps are currently restricted and will be published at a later date.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-31 19:51 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Date Public
2026-07-31 02:49
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-43830",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T19:51:07.430876Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:52:41.957Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-11T13:07:40.371Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://github.com/CVEProject/cvelistV5/blob/8846a06bd73fefb0d7b7e205f1e21f97d0b9cbe2/cves/2026/43xxx/CVE-2026-43830.json"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "tbc",
"vendor": "tbc",
"versions": [
{
"status": "affected",
"version": "tbc"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "tbc"
},
{
"lang": "en",
"type": "finder",
"value": "tbc1"
}
],
"datePublic": "2026-07-31T02:49:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eFull details and mitigation steps are currently restricted and will be published at a later date.\u003c/p\u003e"
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T05:20:00.541Z",
"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"shortName": "CSA"
},
"references": [
{
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-xxx"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "tbc",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"assignerShortName": "CSA",
"cveId": "CVE-2026-43830",
"datePublished": "2026-07-31T02:53:27.625Z",
"dateReserved": "2026-05-04T03:13:26.241Z",
"dateUpdated": "2026-09-11T13:07:40.371Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43829 (GCVE-0-2026-43829)
Vulnerability from cvelistv5 – Published: 2026-07-31 02:48 – Updated: 2026-09-11 13:06
VLAI
EPSS
VEX
Title
tbc
Summary
Full details and mitigation steps are currently restricted and will be published at a later date.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-31 19:47 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
Date Public
2026-07-31 02:41
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-43829",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T19:47:40.588661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:48:20.994Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-11T13:06:41.671Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://github.com/CVEProject/cvelistV5/blob/8846a06bd73fefb0d7b7e205f1e21f97d0b9cbe2/cves/2026/43xxx/CVE-2026-43829.json"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "tbc",
"vendor": "tbc",
"versions": [
{
"status": "affected",
"version": "tbc"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "tbc"
},
{
"lang": "en",
"type": "finder",
"value": "tbc1"
}
],
"datePublic": "2026-07-31T02:41:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"value": "Full details and mitigation steps are currently restricted and will be published at a later date."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T05:18:51.668Z",
"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"shortName": "CSA"
},
"references": [
{
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-xxx"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Advantech,\nthe product owner, has rolled out fixes for all reported vulnerabilities. Users\nand administrators of affected product versions are advised to update to the\nlatest version."
}
],
"value": "Advantech,\nthe product owner, has rolled out fixes for all reported vulnerabilities. Users\nand administrators of affected product versions are advised to update to the\nlatest version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "tbc",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
"assignerShortName": "CSA",
"cveId": "CVE-2026-43829",
"datePublished": "2026-07-31T02:48:23.886Z",
"dateReserved": "2026-05-04T03:13:26.241Z",
"dateUpdated": "2026-09-11T13:06:41.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}