CVE WatchJul 23, 2026

CVE-2026-45776

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, a flaw in Open XDMoD's access control logi

CVSS

4.3

Medium

EPSS

0.2%

p14

KEV

—

Exploit Today

0-100

Published: Jun 5, 2026 · Last modified: Jul 23, 2026 · CWE-284

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-292026-08-26

Technical description

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, a flaw in Open XDMoD's access control logic allows an attacker to submit a crafted HTTPS POST request that sets a session variable used for authorization decisions. If an installation of Open XDMoD includes the optional Job Performance (SUPReMM) module, an attacker could bypass intended data access restrictions and view other users' compute job efficiency metrics. All deployments of Open XDMoD prior to version 11.0.3 that contain the optional Job Performance (SUPReMM) module are impacted. This issue was reported privately on 2026-04-06, and at this time there is no evidence that this vulnerability has been exploited in the wild. The vulnerability was patched in Open XDMoD 11.0.3 on 2026-05-12. As a workaround, apply the patch manually.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-614197.8 HIG

0.7%

——0Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.2d CVE-2026-782457.3 HIG

39.0%

——12A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.3d CVE-2026-782027.3 HIG

20.8%

——6A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used.3d CVE-2026-76609—

14.8%

——4Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.3d CVE-2026-76608—

21.6%

——6Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any access checks.3d CVE-2026-76607—

14.8%

——4Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.3d