CVE-2026-15706

CriticalCVSS 9.8/10Last modified Oct 27, 2026

Description

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass.

This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
Baylan Measuring Instruments Industry and Trade Inc.Baylan Smart Meter Management Application (BMS)< v1.1.10.142

References

Timeline

Published
Aug 20, 2026
Last modified
Oct 27, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-157097.5A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflCVE-2026-15716.1User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execCVE-2026-157106.8An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R14CVE-2026-157117.5A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6CVE-2026-157125.9A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. WheCVE-2026-157135.9A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under spCVE-2026-157146.5An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_streaCVE-2026-157154.3A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functioCVE-2026-157184.3We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability CVE-2026-157195.4We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability CVE-2026-15726.4The Livemesh Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting viCVE-2026-157208.6In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subsc
CVE-2026-15706: Critical severity, CVSS 9.8 | Vulnix