CVE-2026-18451

LowCVSS 3.1/10Last modified Nov 4, 2026

Description

The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-337

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
SMCIMBD-X12SPI01.07.20

References

Timeline

Published
Oct 27, 2026
Last modified
Nov 4, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1845210.0DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit aCVE-2026-184537.5A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthentCVE-2026-184578.3Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext PrCVE-2026-184586.8Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerabCVE-2026-184598.7Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality. This issue affects ConCVE-2026-184606.9Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affectsCVE-2026-184619.2Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection. This iCVE-2026-184627.3Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource MaCVE-2026-184647.5The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unaCVE-2026-184656.5The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unaCVE-2026-184665.4The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing uCVE-2026-184679.8The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and includin
CVE-2026-18451: Low severity, CVSS 3.1 | Vulnix