CVE-2026-17525

MediumCVSS 5.2/10Last modified Oct 16, 2026

Description

Incomplete cleanup vulnerability in ABB My Control System.

This issue affects My Control System: 26.4 and 26.5.

Metrics

CVSS 3.1 5.2/10CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-459

Affected software

No affected versions have been published.

Timeline

Published
Oct 15, 2026
Last modified
Oct 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-175267.2Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role CVE-2026-175277.7In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resourcesCVE-2026-175286.1Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supCVE-2026-175296.3A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agentCVE-2026-17536.8The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to updCVE-2026-175306.3A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolsCVE-2026-175315.0A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/CVE-2026-175326.1The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter in veCVE-2026-175337.2The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network adminisCVE-2026-175345.5Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSaCVE-2026-175356.2Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously craftedCVE-2026-175385.4The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to,
CVE-2026-17525: Medium severity, CVSS 5.2 | Vulnix