CVE-2026-100251

MediumCVSS 6.5/10Last modified Oct 11, 2026

Description

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2026
Last modified: Oct 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1002538.8In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings CVE-2026-1002548.8In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection CVE-2026-1002559.8In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset CVE-2026-1002567.8In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects CVE-2026-1002574.3In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export CVE-2026-1002584.3In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings CVE-2026-1002594.3In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access CVE-2026-100267.2The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insuffici CVE-2026-1002605.3In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset CVE-2026-1002615.4In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission CVE-2026-1002627.1In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notificatio CVE-2026-1002636.1In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible