CVE-2026-126316

LowCVSS 2.2/10Last modified Nov 13, 2026

Description

Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscription key from recorded URLs.

Metrics

CVSS 3.1 2.2/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-598

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1263178.8Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company detail CVE-2026-1263184.3REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the version[live_version] permission to modi CVE-2026-1263196.5Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create permission to read s CVE-2026-126326.5Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off t CVE-2026-1263206.5Dockhand before 1.0.55 contains an improper authorization vulnerability that lets users holding only containers:view download arbitrary cont CVE-2026-1263218.3Dockhand before 1.0.55 contains a path traversal vulnerability that allows authenticated users with stacks:edit to bypass the file-browser p CVE-2026-1263228.1OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to control patient-matching c CVE-2026-1263234.3Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions beca CVE-2026-1263259.0A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited CVE-2026-126326Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated CVE-2026-126327Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to v CVE-2026-126328Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticate