CVE-2026-126993
A security flaw has been discovered in SiteServer SSCMS up to 7.2.2. Impacted is an unknown function of the file /api/v1/captcha. Performing
CVSS
5.3
Média
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 12 de nov. de 2026 · Última mod.: 12 de nov. de 2026 · CWE-310 · CWE-326
Ainda não há histórico EPSS suficiente.
A security flaw has been discovered in SiteServer SSCMS up to 7.2.2. Impacted is an unknown function of the file /api/v1/captcha. Performing a manipulation of the argument Value results in inadequate encryption strength. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-918923.7 BAI—
——0Dell Terraform Provider for PowerFlex, versions prior to 1.9.0, contains a vulnerability that may permit the use of deprecated cryptographic protocols during secure communications. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.1dCVE-2026-1022198.1 ALT36.3%
——11Inadequate encryption strength in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network.2dCVE-2026-1211098.1 ALT1.7%
——1Inadequate encryption strength in SSL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via crafted network traffic. (Chromium security severity: Low)2dCVE-2026-1202233.1 BAI24.9%
——7A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently random values. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.10dCVE-2026-632867.1 ALT0.1%
——0Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete all these backups and change the credentials stored in AXIS Camera Station Pro.7dCVE-2026-1161143.7 BAI8.5%
——3A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive information. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.17d