CVE-2026-127036

HighCVSS 8.6/10Last modified Nov 12, 2026

Description

Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS.

This issue affects WebFOCUS: 9.1, from 9.2 through 7, and from 9.3 through 7.

Metrics

CVSS 4.0 8.6/10CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-93

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 12, 2026
Last modified
Nov 12, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-127046.8When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML respCVE-2026-1270469.2The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /externaCVE-2026-127056.4Missing support for integrity check vulnerability in ABB KNX Update Tool (ABB), ABB KNX Update Tool (BJE). This issue affects KNX Update ToCVE-2026-1270506.4Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker tCVE-2026-1270567.5PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause deCVE-2026-1270584.9WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attCVE-2026-127066.5A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompCVE-2026-127077.5Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake clientCVE-2026-127088.7Summary Cloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAGRAM handling. FCVE-2026-12715.3The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versioCVE-2026-127109.3A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04CVE-2026-127109A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context
CVE-2026-127036: High severity, CVSS 8.6 | Vulnix