CVE-2026-108292

MediumCVSS 5.5/10Last modified Nov 9, 2026

Description

IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-434

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
IBMProcess Mining>= 2.0.0, <= 2.2.1

References

Timeline

Published
Nov 8, 2026
Last modified
Nov 9, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-10834.4The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form field configuratiCVE-2026-108308.8The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is notCVE-2026-1083016.0Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-1083024.3Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-1083038.8Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.CVE-2026-1083047.8Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-1083057.8Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-1083067.8Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-1083077.8Tanium addressed a heap-based buffer overflow vulnerability in Index.CVE-2026-1083086.5Tanium addressed a SQL injection vulnerability in Patch.CVE-2026-1083095.5Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.CVE-2026-108316.9A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does
CVE-2026-108292: Medium severity, CVSS 5.5 | Vulnix