CVE-2026-106020

HighCVSS 8.6/10Last modified Nov 10, 2026

Description

Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking.

This issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0.

Metrics

CVSS 4.0 8.6/10CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected software

VendorProductVersions
Johnson ControlsEasyIO Neo IO Manager and Tools Installer1.1.0.0

References

Timeline

Published
Nov 6, 2026
Last modified
Nov 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1060228.6Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows RetriCVE-2026-106023NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP ServCVE-2026-1060255.3The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updateCVE-2026-1060263.7tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jumpCVE-2026-1060275.3The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the reqCVE-2026-1060285.3The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons,CVE-2026-1060297.5The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and CVE-2026-1060306.8NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipCVE-2026-1060316.5The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuCVE-2026-1060325.7Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit bCVE-2026-1060335.4A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the applicatCVE-2026-1060345.0A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary
CVE-2026-106020: High severity, CVSS 8.6 | Vulnix