CVE-2026-115646

CriticalCVSS 9.8/10Last modified Nov 10, 2026

Description

Partial String Comparison Vulnerability in HiRDB.

This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50-/F through 09-66/V; HiRDB Server Version 9(32): from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-50-/F through 09-66-/V.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-187

Affected software

Vendor	Product	Versions
Hitachi	HiRDB Server Version 10	>= 10-00, < 10-12-01
Hitachi	HiRDB Server Version 9	>= 09-50-06, <= 09-66-22
Hitachi	HiRDB Server with Additional Function Version 9	>= 09-50-/F, <= 09-66/V
Hitachi	HiRDB Server Version 9(32)	>= 09-50-06, <= 09-66-22
Hitachi	HiRDB Server with Additional Function Version 9(32)	>= 09-50-/F, <= 09-66-/V

References

https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-165/index.html

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-115658.5The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions,CVE-2026-1156537.0In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module t CVE-2026-1156546.9In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a CVE-2026-1156574.8When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured cre CVE-2026-115675.9The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variabl CVE-2026-1156737.5The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an CVE-2026-1156785.3Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in SNMP processing CVE-2026-1156796.5Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX Buffer CVE-2026-115687.5The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before return CVE-2026-1156806.5Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission CVE-2026-1156836.8A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world s CVE-2026-115695.4A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository wri