CVE-2026-116282

MediumCVSS 4.3/10Last modified Oct 26, 2026

Description

A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-284

Affected software

Vendor	Product	Versions
n/a	Kameleo	5.3.0; 5.3.1

References

Timeline

Published: Oct 26, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1162834.3A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. Thi CVE-2026-1162844.3A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of CVE-2026-1162857.5HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In c CVE-2026-1162899.1Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner registration-t CVE-2026-116298.8Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2026-1162966.5The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with w CVE-2026-11634.1An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active CVE-2026-116308.8Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a CVE-2026-1163033.1Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on th CVE-2026-1163048.8Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbi CVE-2026-1163068.8Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system use CVE-2026-1163078.8Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, vi