CVE-2026-101146

MediumCVSS 4.3/10Last modified Oct 20, 2026

Description

A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService of the component GWT RPC Handler. Performing a manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Sep 28, 2026
Last modified: Oct 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1011478.8The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do no CVE-2026-10114810.0The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or bl CVE-2026-1011494.1Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary CVE-2026-101154.3A vulnerability was identified in Open5GS up to 2.7.7. This affects an unknown part in the library lib/sbi/nnrf-handler.c of the component S CVE-2026-1011504.1Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary CVE-2026-1011514.3Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user,CVE-2026-1011528.0Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clic CVE-2026-1011538.0On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user CVE-2026-1011547.2An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope thro CVE-2026-1011559.1An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope thro CVE-2026-1011568.4A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a c CVE-2026-1011578.7A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious con