CVE-2026-12577

HighCVSS 8.7/10Last modified Jul 1, 2026

Description

DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-358

Affected software

No affected versions have been published.

Timeline

Published
Jul 1, 2026
Last modified
Jul 1, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-125788.4The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code.CVE-2026-125797.4AS228T with Authentication Bypass VulnerabilityCVE-2026-12584.9The Mail Mint plugin for WordPress is vulnerable to blind SQL Injection via the 'forms', 'automation', 'email/templates', and 'contacts/impoCVE-2026-125805.4EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persisCVE-2026-125817.5EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID fCVE-2026-125828.6The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL CVE-2026-125838.1The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowCVE-2026-125847.5The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provideCVE-2026-125858.1The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind theCVE-2026-125868.1The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating CVE-2026-125878.6The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the applicaCVE-2026-125886.0An attacker with access to an HX 10.0.0  and previous versions, may send specially-crafted data to the HX console. The malicious detection w
CVE-2026-12577: High severity, CVSS 8.7 | Vulnix