CVE-2026-12694

CriticalCVSS 9.1/10Last modified Oct 24, 2026

Description

Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
Vimesoft Inc.Enterprise Video Platform>= 3.11.0.0, < 3.25.0

References

Timeline

Published
Jul 17, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-126958.1The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secreCVE-2026-1269575.3An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICCVE-2026-126965.4The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribuCVE-2026-126975.4The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting iCVE-2026-126984.3The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowCVE-2026-1269915.3The Wikidata Lookup expansion module (wiki.py) in MISP misp-modules contained a SPARQL injection vulnerability. The handler function construCVE-2026-1269935.3A security flaw has been discovered in SiteServer SSCMS up to 7.2.2. Impacted is an unknown function of the file /api/v1/captcha. PerformingCVE-2026-1269946.3A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file braindecode/models/util.CVE-2026-1269956.3A vulnerability was found in tjake Jlama up to 0.8.4/0.9.0-beta. Affected by this vulnerability is the function SafeTensorIndex.loadWeights CVE-2026-1269966.3A vulnerability was determined in SakanaAI text-to-LoRA 0.0.1. Affected by this issue is the function get_tokenizer of the file src/hyper_llCVE-2026-1269977.3A vulnerability was identified in JeecgBoot up to 3.9.6. This affects the function RestTemplate.exchange of the file org/jeecg/modules/airagCVE-2026-1269987.3A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /op
CVE-2026-12694: Critical severity, CVSS 9.1 | Vulnix