CVE-2026-92744
Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.
CVSS
—
Sem CVSS
EPSS
0.3%
p17
KEV
—
Exploit Today
5
0-100
Publicado: 29 de out. de 2026 · Última mod.: 30 de out. de 2026 · CWE-295 · CWE-306
0.3%EPSS · 30 dias0.3%
2026-10-302026-11-07
Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1235305.9 MÉD—
———Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable TOTP without the account password. Attackers can call the TOTP enroll and enable endpoints with their own secret to lock the owner out, persisting even after password reset.8hCVE-2026-1239637.3 ALT—
——0A security vulnerability has been detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The impacted element is the function register of the file im_server/app.py of the component Agent Registry. Such manipulation of the argument desc/name leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.21hCVE-2026-191296.8 MÉD14.8%
——4IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a network-positioned attacker to intercept backup data due to improper verification of the backup server's identity. The identity of the backup server is not verified when the secure connection for analytics backups is established, which could allow backup data, and credentials if used, to be intercepted.1dCVE-2026-173338.0 ALT12.1%
——4IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation.1dCVE-2026-173328.7 ALT19.7%
——6IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation.1dCVE-2026-173248.3 ALT40.1%
——12IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function.1d