CVE Watch11 de nov. de 2026

CVE-2026-126797

NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge admi

CVSS

9.8

Crítica

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 11 de nov. de 2026 · Última mod.: 11 de nov. de 2026 · CWE-321

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-646829.8 CRÍ

48.1%

——14AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role: "owner" and obtain full administrative control of the CMS — creating/deleting content, users, media, redirects, and configuration. This issue has been patched in version 3.4.0.21h CVE-2026-0003—

4.6%

——1Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality.1d CVE-2026-1246046.2 MÉD

1.4%

——0The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.2d CVE-2026-1246026.2 MÉD

1.4%

——0The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.2d CVE-2026-1245996.2 MÉD

1.4%

——0The RSA cryptographic key material, including a private key and public key, is embedded within the application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.2d CVE-2026-1245987.5 ALT

14.2%

——4An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.2d