CVE-2026-12250

HighCVSS 7.9/10Last modified Oct 25, 2026

Description

Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Domain Joiner allows Excavation.

This issue affects Pardus Domain Joiner: from 0.5.2 before 0.5.4.

Metrics

CVSS 3.1 7.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-214

Affected software

No affected versions have been published.

Timeline

Published: Jul 5, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-122518.1The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on i CVE-2026-122527.8In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDepe CVE-2026-122546.4Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point w CVE-2026-122558.1The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when passw CVE-2026-122568.8Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusi CVE-2026-122579.3Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/i CVE-2026-122589.2Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter CVE-2026-122596.5In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract CVE-2026-12267.0CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the ap CVE-2026-1226010.0SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/au CVE-2026-122616.5A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader ex CVE-2026-122638.8Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass