CVE-2026-1962

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Attachment Migration. The manipulation leads to improper access controls. The attack may be initiated remotely. Upgrading to version 8.21 is sufficient to resolve this issue. The identifier of the patch is 053bf1dfb76ef230db162c64a6ed50ebedf67eee. It is recommended to upgrade the affected component.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266 CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Feb 5, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-196208.8IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.CVE-2026-196216.5Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from p CVE-2026-196229.8IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validatio CVE-2026-196247.8A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) u CVE-2026-196255.3When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by CVE-2026-196269.9A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrat CVE-2026-196278.2IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due t CVE-2026-196287.2A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration v CVE-2026-196298.1A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" per CVE-2026-19639.8A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachmen CVE-2026-196307.5In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by CVE-2026-196314.9A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, po