CVE-2026-2207

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/publications/activities.js of the component Activity Publication Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. Upgrading to version 8.21 is capable of addressing this issue. This patch is called 91a936e07d2976d4246dfe834281c3aaa87f9503. You should upgrade the affected component.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Feb 8, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-220709.8ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.CVE-2026-220728.3Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.CVE-2026-220775.6OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may CVE-2026-220787.3Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions CVE-2026-220798.7This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the plaintext transmissio CVE-2026-22086.5A security vulnerability has been detected in WeKan up to 8.20. Impacted is an unknown function of the file server/publications/rules.js of CVE-2026-220808.7This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the transmission of crede CVE-2026-220818.8This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag CVE-2026-220828.8This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the use of login credenti CVE-2026-22094.3A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/se CVE-2026-220939.5The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This a CVE-2026-220949.3The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is ex