rootpwn

high · CVSS v3 6.5 · CVSS v4 8.7

CVE-2026-94381

MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API …

Description

MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions. Exploiting the issue requires a valid read-only API key and a single request to the affected function. The main impact is that MISP’s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent. Version affected: <2.5.47

Scores

Severity
high
CVSS v2
4
CVSS v3
6.5
CVSS v4
8.7
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-94144

A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library orm_lib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

high

CVE-2026-94139

A command injection flaw exists in the Cookie Handler of Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656 via the /send_order.cgi?parameter=loginout endpoint. Attackers can remotely inject OS commands by manipulating the session_id parameter. The vulnerability is publicly exploitable and the vendor has not released a fix.

View analysis

high

CVE-2026-94143

The drogonframework up to version 1.9.13 contains a SQL injection vulnerability in Mapper::orderBy that can be triggered remotely via manipulated sort arguments. This flaw is publicly known and could allow attackers to read, modify, or delete database contents.

View analysis

high

CVE-2026-94184

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening. Affects v5.0.8 through v6.6.6.

View analysis