CVE-2026-44415

Publié : 13 octobre 2026

Modifié : 13 octobre 2026

Score CVSS

9.1

CRITICAL

Description détaillée

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Références et Patchs

https://cert-portal.siemens.com/productcert/html/ssa-377139.html https://cert-portal.siemens.com/productcert/html/ssa-832641.html

Dernières Vulnérabilités

CVE-2026-94410

A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.

VOIR DÉTAILS

CVE-2026-89279

Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing. This issue affects authtake: from v1.3 before v1.4.

VOIR DÉTAILS

CVE-2026-63316

A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 3.90.0 and 4.0.0-canary.34.

VOIR DÉTAILS