CVE-2026-2406

MediumCVSS 6.5/10Last modified Aug 5, 2026

Description

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client.

This issue affects Online Registration and Workflow Management System: through 12022026.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jul 22, 2026
Last modified: Aug 5, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-240609.1Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an CVE-2026-240619.8telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.CVE-2026-240627.8The "Privileged Helper" component of the Arturia Software Center (MacOS) does not perform sufficient client code signature validation when a CVE-2026-240638.2When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. Thi CVE-2026-240647.8Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component in CVE-2026-240658.1Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. CVE-2026-240668.4Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the CVE-2026-240678.4Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the CVE-2026-240688.8The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the N CVE-2026-240695.4Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the ap CVE-2026-240708.8During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helper2`, which is used b CVE-2026-240717.8It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its cod