CVE-2026-11348

HighCVSS 8.1/10Last modified Oct 25, 2026

Description

Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data.

This issue affects Liman MYS: before release.Master.1107.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published
Jul 7, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1134814.3The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosingCVE-2026-1134826.8The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attributCVE-2026-1134856.5The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handCVE-2026-1134866.5The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-sitCVE-2026-1134876.8The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputtiCVE-2026-1134886.8The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before CVE-2026-1134894.3The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing CVE-2026-113498.6The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise andCVE-2026-1134905.3The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup througCVE-2026-1134916.4The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saviCVE-2026-1134925.3The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of itsCVE-2026-1134936.8The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them w
CVE-2026-11348: High severity, CVSS 8.1 | Vulnix