CVE-2026-105813

MediumCVSS 6.3/10Last modified Nov 12, 2026

Description

Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-312

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Ivanti	User Workspace Manager	—

References

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-User-Workspace-Manager-CVE-2026-105813?language=en_US

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1058145.3TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protect CVE-2026-1058157.1TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The e CVE-2026-1058168.0Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin di CVE-2026-1058185.9Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificate CVE-2026-105827.4Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone.CVE-2026-1058205.4Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned CVE-2026-1058218.3The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request ser CVE-2026-1058228.3The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value withou CVE-2026-1058286.3Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validati CVE-2026-1058296.1League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the Di CVE-2026-105834.7A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. Affected by this issue is the function Import of the fil CVE-2026-1058307.5league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table e