CVE-2026-12091

MediumCVSS 5.3/10Last modified Oct 12, 2026

Description

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a denial of service due to a heap-based out-of-bounds read. A remote attacker could send a specially crafted request that causes a limited out‑of‑bounds memory read.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Oct 8, 2026
Last modified
Oct 12, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-120935.3The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due toCVE-2026-120945.3The Advanced Contact Form 7 - Compact DB plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability cheCVE-2026-120957.2The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'api_urlCVE-2026-120975.3The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2. This is due to theCVE-2026-120986.4The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed' Episode Meta FieldCVE-2026-12106.4The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_elementor_data' meta field in allCVE-2026-121007.2The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' paCVE-2026-121018.1IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation oCVE-2026-121022.7The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to CVE-2026-121034.3The Wallet for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.4. This is dCVE-2026-121048.6OS command injection in the environment and tunnel configuration functionality in SIMA GmbH Bondix through version 1.25.7.5 on Linux allows CVE-2026-121056.5Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication
CVE-2026-12091: Medium severity, CVSS 5.3 | Vulnix