CVE-2026-1194

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in MineAdmin 1.x/2.x. This affects an unknown function of the component Swagger. The manipulation results in information disclosure. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-284

Affected software

Vendor	Product	Versions
n/a	MineAdmin	1.; 2.

References

https://github.com/SourByte05/MineAdmin-Vulnerability/issues/5Exploit, Issue Tracking, Mitigation, Third Party Advisory
https://vuldb.com/?ctiid.341779Permissions Required, VDB Entry
https://vuldb.com/?id.341779Third Party Advisory, VDB Entry
https://vuldb.com/?submit.734271Third Party Advisory, VDB Entry

Timeline

Published: Jan 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-119407.8tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored a CVE-2026-1194017.0Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.CVE-2026-1194027.0Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.CVE-2026-1194037.0Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.CVE-2026-1194045.9Improper access control in Windows Client for NFS allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1194057.0Use after free in Windows Backup Engine allows an authorized attacker to elevate privileges locally.CVE-2026-1194077.1Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthe CVE-2026-1194088.8n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Functi CVE-2026-1194097.2OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to exe CVE-2026-119415.6Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions. The “quiche_connection_id CVE-2026-1194144.3Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization membe CVE-2026-1194153.7CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsani