CVE Watch19 oct 2026

CVE-2026-112144

A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unkno

CVSS

5.3

Medio

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 19 oct 2026 · Última mod.: 19 oct 2026 · CWE-425 · CWE-552

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessible. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1026958.2 ALT

21.9%

——7OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure. This issue is fixed in versions 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2.20h CVE-2026-108070—

37.7%

——11A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.5d CVE-2026-968575.5 MED

31.5%

——9Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally.21h CVE-2026-881376.5 MED

60.7%

——18Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network.4d CVE-2026-858406.5 MED

60.7%

——18Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network.4d CVE-2026-858125.5 MED

40.8%

——12Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.4d