CVE-2026-18642

HighCVSS 7.8/10Last modified Oct 23, 2026

Description

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection.

This issue affects eta-otp-lock: before 1.0.4.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
TUBITAK BILGEM Software Technologies Research Instituteeta-otp-lock< 1.0.4

References

Timeline

Published
Aug 3, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-186445.4A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of CVE-2026-186455.4A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_content of the file /system/admin/admin.php CVE-2026-186465.3A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the coCVE-2026-186477.3A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the functionCVE-2026-186485.3A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectorCVE-2026-186497.5A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maxiCVE-2026-18656.5The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & LCVE-2026-186508.8Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Privilege Escalation. This issue affects Liman MYS: from 2.2.3 beforeCVE-2026-186515.4A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before perCVE-2026-186526.5Velociraptor allows reading Stacked result sets from the GUI.  Velociraptor's multi-tenant design stores sub orgs within the datastore direcCVE-2026-186537.2The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing admCVE-2026-186546.8Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 migh
CVE-2026-18642: High severity, CVSS 7.8 | Vulnix