CVE-2026-122157

MediumCVSS 6.3/10Last modified Nov 5, 2026

Description

A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.93.1 addresses this issue. The name of the patch is 59f85d48f17a70a402ad59dcecacdbec20f954df. Upgrading the affected component is recommended.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77CWE-78

Affected software

VendorProductVersions
PuroceanYank Note3.93.0

References

Timeline

Published
Nov 5, 2026
Last modified
Nov 5, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1221584.7A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create CVE-2026-1221596.3A weakness has been identified in Edge0-AI Audio8_TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntimCVE-2026-122165.3A weakness has been identified in svaarala duktape up to 2.99.99. This issue affects some unknown processing of the file duk_api_bytecode.c.CVE-2026-1221606.3A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModel_PEFT of the fCVE-2026-1221625.5Integer underflow (wrap or wraparound) in Windows Update Stack allows an authorized attacker to disclose information locally.CVE-2026-1221637.5Double free in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.CVE-2026-1221648.0Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network.CVE-2026-1221657.8Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.CVE-2026-1221667.8Stack-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.CVE-2026-1221676.8Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1221687.8Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.CVE-2026-1221697.5Insufficient granularity of access control in Windows IKE Extension allows an authorized attacker to perform spoofing locally.
CVE-2026-122157: Medium severity, CVSS 6.3 | Vulnix