high · CVSS v3 7.3 · CVSS v4 6.9

CVE-2026-112143

A flaw in the satya-vinay Events-Management-System allows remote attackers to bypass authentication on multiple endpoints. The vulnerability

Overview

A flaw in the satya-vinay Events-Management-System allows remote attackers to bypass authentication on multiple endpoints. The vulnerability exists in all releases up to commit 437c77c. It could enable unauthorized access to event data and management functions.

Description

A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.

Impact

Confidentiality: attackers can view or modify event data. Integrity: unauthorized changes to event schedules. Availability: potential denial of service by exhausting resources. Defenders: system administrators and users of the Events-Management-System.

Remediation

Apply the latest patch from the vendor or update to a commit newer than 437c77c. If a patch is not yet available, disable exposed endpoints or enforce strict authentication, use a web application firewall to block unauthenticated requests, and monitor logs for suspicious activity.

Risk context

High severity (CVSS 7.3) with no EPSS data; the vulnerability is publicly known and exploitable remotely, so prompt action is recommended.

Affected products

  • satya-vinay Events-Management-System

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.3
CVSS v4
6.9
EPSS
—

authentication-bypass remote-exploit web-application high-severity events-management vulnerability patch-needed

← All CVEs

Related CVEs

high

CVE-2026-112107

A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis

high

CVE-2026-112102

A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis

high

CVE-2026-112188

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys. A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller. The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints. Affected versions: <2.5.48.

View analysis

high

CVE-2026-64945

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

View analysis