CVE-2026-116283

MediumCVSS 4.3/10Last modified Oct 31, 2026

Description

A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. The attack is possible to be carried out remotely. Upgrading to version 5.2.0 is able to mitigate this issue. Upgrading the affected component is advised.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-284

Affected software

Vendor	Product	Versions
n/a	Kameleo	5.0.1.0; 5.0.1.1; 5.0.1.2; 5.0.1.3; 5.0.1.4; 5.0.1.5; 5.0.1.6; 5.0.1.7; 5.0.1.8; 5.0.1.9; 5.0.1.10; 5.0.1.11; 5.0.1.12; 5.0.1.13; 5.0.1.14; 5.0.1.15; 5.0.1.16; 5.0.1.17; 5.0.1.18; 5.0.1.19

References

Timeline

Published: Oct 26, 2026
Last modified: Oct 31, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1162844.3A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of CVE-2026-1162857.5HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In c CVE-2026-1162899.1Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner registration-t CVE-2026-116298.8Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2026-1162966.5The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with w CVE-2026-11634.1An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active CVE-2026-116308.8Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a CVE-2026-1163033.1Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on th CVE-2026-1163048.8Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbi CVE-2026-1163068.8Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system use CVE-2026-1163078.8Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, vi CVE-2026-1163084.3Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token. Versions bef