CVE-2026-116280

MediumCVSS 5.5/10Last modified Oct 31, 2026

Description

A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation of the argument host/port can lead to server-side request forgery. The attack may be launched remotely. Upgrading to version 5.2.0 is able to address this issue. It is suggested to upgrade the affected component. The route has been removed and replaced with /general/test-proxy in 5.2.0.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
n/a	Kameleo	5.0.1.0; 5.0.1.1; 5.0.1.2; 5.0.1.3; 5.0.1.4; 5.0.1.5; 5.0.1.6; 5.0.1.7; 5.0.1.8; 5.0.1.9; 5.0.1.10; 5.0.1.11; 5.0.1.12; 5.0.1.13; 5.0.1.14; 5.0.1.15; 5.0.1.16; 5.0.1.17; 5.0.1.18; 5.0.1.19

References

Timeline

Published: Oct 26, 2026
Last modified: Oct 31, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1162813.3A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-eng CVE-2026-1162824.3A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file CVE-2026-1162834.3A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. Thi CVE-2026-1162844.3A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of CVE-2026-1162857.5HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In c CVE-2026-1162899.1Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner registration-t CVE-2026-116298.8Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2026-1162966.5The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with w CVE-2026-11634.1An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active CVE-2026-116308.8Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a CVE-2026-1163033.1Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on th CVE-2026-1163048.8Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbi