critical · CVSS v3 8.8 · CVSS v4 9.4

CVE-2026-97718

CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a …

Description

CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.

Scores

Severity
critical
CVSS v2
6.8
CVSS v3
8.8
CVSS v4
9.4
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-120228

A critical OS command injection flaw exists in the ioos service of WAVLINK WN553X1-B routers. Remote attackers can manipulate group_id/group_name arguments to execute arbitrary commands. The vulnerability can compromise device control and network security.

View analysis

critical

CVE-2026-120279

A critical OS command injection flaw exists in the openvpn_cli handler of WAVLINK WN536AX6-A routers, allowing remote attackers to execute arbitrary commands via the file_id parameter. The vulnerability can be exploited over the network without authentication. It has been publicly disclosed and is actively used by threat actors.

View analysis

critical

CVE-2026-58968

In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

View analysis

critical

CVE-2026-58978

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

View analysis