CVE WatchJul 8, 2026

CVE-2026-6280

Exposure of sensitive information due to incompatible policies vulnerability in NOMYSOFT Informatics Education and Consulting Inc. Nomysem a

CVSS

6.5

Medium

EPSS

0.2%

p13

KEV

—

Exploit Today

0-100

Published: Jul 8, 2026 · Last modified: Jul 8, 2026 · CWE-213

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-082026-07-16

Technical description

Exposure of sensitive information due to incompatible policies vulnerability in NOMYSOFT Informatics Education and Consulting Inc. Nomysem allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Nomysem: through 08072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Official references

siberguvenlik.gov.trhttps://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0516

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-332168.6 HIG

28.8%

——9NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.2d