CVE Watch12 ago 2026

CVE-2019-11634

Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability

CVSS

9.8

Crítico

EPSS

8.0%

p94

KEV

SÍ

3 nov 2021

Exploit Today

0-100

Publicado: 22 may 2019 · Última mod.: 12 ago 2026 · CWE-284

EPSS · 30d

8.0%EPSS · 30 días8.0%

2026-08-022026-08-31

Ficha del catálogo KEV

Producto

Citrix / Workspace Application and Receiver for Windows

Vulnerabilidad

Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability

Añadido a KEV

3 nov 2021

Remediar antes de

3 may 2022

Uso conocido en ransomware

Sí

Descripción resumida

Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives.

Acción requerida

Apply updates per vendor instructions.

Notas

https://nvd.nist.gov/vuln/detail/CVE-2019-11634

Descripción técnica

Citrix Workspace App before 1904 for Windows has Incorrect Access Control.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-828176.3 MED

—

———A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the component Tenant Administrator Management API. Performing a manipulation of the argument tenantId results in improper access controls. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.2h CVE-2026-828157.3 ALT

—

———A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file web/server.go of the component Middleware. This manipulation of the argument X-Forwarded-For/X-Real-IP/True-Client-IP causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.2h CVE-2026-828103.3 BAJ

—

———A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information disclosure. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.3h CVE-2026-828094.3 MED

—

———A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "At this time, vidIQ does not accept security vulnerability submissions, and we do not have a bug bounty program in place."2h CVE-2026-78076—

—

———Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin). An authenticated user could submit modified layout parameters for arbitrary menu items without proper authorization.5h CVE-2026-78074—

—

———Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.5h