CVE-2026-126993

MediumCVSS 5.3/10Last modified Nov 12, 2026

Description

A security flaw has been discovered in SiteServer SSCMS up to 7.2.2. Impacted is an unknown function of the file /api/v1/captcha. Performing a manipulation of the argument Value results in inadequate encryption strength. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-310 CWE-326

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1269946.3A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file braindecode/models/util.CVE-2026-1269956.3A vulnerability was found in tjake Jlama up to 0.8.4/0.9.0-beta. Affected by this vulnerability is the function SafeTensorIndex.loadWeights CVE-2026-1269966.3A vulnerability was determined in SakanaAI text-to-LoRA 0.0.1. Affected by this issue is the function get_tokenizer of the file src/hyper_ll CVE-2026-1269977.3A vulnerability was identified in JeecgBoot up to 3.9.6. This affects the function RestTemplate.exchange of the file org/jeecg/modules/airag CVE-2026-1269987.3A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /op CVE-2026-127019.0A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin wit CVE-2026-1270169.2The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that di CVE-2026-127024.9In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deploymen CVE-2026-1270297.5A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling au CVE-2026-127038.0TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to by CVE-2026-1270307.5A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session tic CVE-2026-1270368.6Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS. This issue affects WebFOCUS: 9.1, from 9.2 thro