CVE-2026-101893

Publié : 5 octobre 2026

Modifié : 5 octobre 2026

Score CVSS

4.4

MEDIUM

Description détaillée

Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Références et Patchs

https://mediaserver.newellrubbermaid.com/industrial/Help/win/en/Content/What's%20New.htm https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-275-01.json https://www.cve.org/CVERecord?id=CVE-2026-101893 https://www.dymo.com/support?cfid=user-guide

Dernières Vulnérabilités

CVE-2026-93321

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

VOIR DÉTAILS

CVE-2026-93315

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.

VOIR DÉTAILS

CVE-2026-91107

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.

VOIR DÉTAILS