CVE WatchJul 14, 2026

CVE-2026-15491

A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. Thi

CVSS

7.3

High

EPSS

0.6%

p46

KEV

—

Exploit Today

0-100

Published: Jul 12, 2026 · Last modified: Jul 14, 2026 · CWE-287 · CWE-306

EPSS · 30d

0.5%EPSS · 30 days0.6%

2026-07-122026-07-17

Technical description

A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation causes missing authentication. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-32489.8 CRI

100.0%

KEV—80Langflow Missing Authentication Vulnerability3d CVE-2024-116809.8 CRI

99.8%

KEV—80ProjectSend Improper Authentication Vulnerability3d CVE-2026-561645.3 MED

92.0%

KEV—78Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability3d CVE-2026-468179.8 CRI

60.3%

KEV—68Oracle E-Business Suite Improper Privilege Management Vulnerability2d CVE-2023-278239.8 CRI

98.9%

——30An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.9d CVE-2022-245629.8 CRI

98.9%

——30In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution.9d