CVE-2026-1697

MediumCVSS 6.5/10Last modified Jul 9, 2026

Description

The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-614 CWE-1275

Affected software

Vendor	Product	Versions
arcinfo	PcVue	>= 16.0.0, <= 16.3.3; >= 15.0.0, <= 15.2.13; 12.0.0

References

https://www.pcvue.com/security/#SB2026-2Vendor Advisory

Timeline

Published: Feb 26, 2026
Last modified: Jul 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-169704.2The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies CVE-2026-169715.9The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.CVE-2026-169727.5IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to improper authentication.CVE-2026-169735.5IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to disclose sensitive kernel memory due to an out-of-bounds read.CVE-2026-169746.4The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the po CVE-2026-169758.8IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a heap-based buffer overflow.CVE-2026-169778.1The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a d CVE-2026-169794.3The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX action CVE-2026-16986.1A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, CVE-2026-169805.5IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper validation of symbol CVE-2026-169815.3The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login CVE-2026-169827.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.