CVE-2026-113469

HighCVSS 7.5/10Last modified Oct 20, 2026

Description

A failure has been identified in the SNS during dynamic data files signature check.

A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Oct 20, 2026
Last modified
Oct 20, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-113478.5The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charseCVE-2026-1134705.4Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, FiCVE-2026-1134725.4The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endCVE-2026-113488.1Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data. This issue affectCVE-2026-1134894.3The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing CVE-2026-113498.6The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise andCVE-2026-1134905.3The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup througCVE-2026-1134916.4The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saviCVE-2026-1134925.3The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of itsCVE-2026-1134936.8The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them wCVE-2026-1134955.0A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to bCVE-2026-1134965.0A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed direct
CVE-2026-113469: High severity, CVSS 7.5 | Vulnix