CVE-2026-12183

CriticalCVSS 9.8/10Last modified Aug 10, 2026

Description

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability (CWE-287) in the system configuration module.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287 CWE-306

Affected software

Vendor	Product	Versions
Nefteprodukttekhnika LLC	BUK TS-G Gas Station Automation System	>= 2.9.1, <= 2.10.2

References

Timeline

Published: Jun 13, 2026
Last modified: Aug 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1218374.3A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @Secur CVE-2026-1218417.3Other issue in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.CVE-2026-1218428.8Privilege escalation in the Reader View component in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.CVE-2026-1218438.8Privilege escalation in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.CVE-2026-1218488.8The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the cho CVE-2026-121858.6In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bo CVE-2026-1218535.3The AppPresser WordPress plugin before 5.0.0 does not restrict access to two of its REST API endpoints, allowing unauthenticated visitors t CVE-2026-1218574.2The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returni CVE-2026-1218586.3The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries i CVE-2026-121868.8A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library /usr/lib/oui-httpd/CVE-2026-1218628.8The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishe CVE-2026-1218637.1The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in the response o