CVE-2026-1050

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. This affects an unknown function of the file source-code/src/main/java/net/risesoft/util/Y9PlatformUtil.java of the component REST Authenticate Endpoint. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jan 17, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1050037.8Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.CVE-2026-1050047.8Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.CVE-2026-1050058.1Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.CVE-2026-1050066.4Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1050078.8An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length CVE-2026-1050089.0No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.CVE-2026-1050097.5Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.CVE-2026-1050109.8Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.CVE-2026-1050137.4Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-1050149.1Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to exCVE-2026-1050169.8Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.CVE-2026-1050294.3UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controlle
CVE-2026-1050: High severity, CVSS 7.3 | Vulnix