CVE-2026-12250

HighCVSS 7.9/10Last modified Oct 25, 2026

Description

Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Domain Joiner allows Excavation.

This issue affects Pardus Domain Joiner: from 0.5.2 before 0.5.4.

Metrics

CVSS 3.1 7.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-214

Affected software

VendorProductVersions
TUBITAK BILGEM Software Technologies Research InstitutePardus Domain Joiner>= 0.5.2, < 0.5.4

References

Timeline

Published
Jul 5, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-122518.1The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on iCVE-2026-1225186.5Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.CVE-2026-122527.8In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDepeCVE-2026-122546.4Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point wCVE-2026-122558.1The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when passwCVE-2026-122568.8Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects FusiCVE-2026-122579.3Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/iCVE-2026-122589.2Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter CVE-2026-122596.5In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extractCVE-2026-12267.0CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the apCVE-2026-1226010.0SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auCVE-2026-122616.5A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader ex
CVE-2026-12250: High severity, CVSS 7.9 | Vulnix