CVE-2026-2513

MediumCVSS 6.1/10Last modified Sep 3, 2026

Description

A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 12, 2026
Last modified
Sep 3, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-251309.6Cybersecurity AI (CAI) is a framework for AI Security. In versions up to and including 0.5.10, the CAI (Cybersecurity AI) framework containsCVE-2026-251318.8OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken AcCVE-2026-251334.8October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSCVE-2026-251348.8Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceConCVE-2026-251354.5OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 have an infCVE-2026-251366.1Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizablCVE-2026-251379.1The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly expCVE-2026-251385.3Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizablCVE-2026-251399.1RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other emCVE-2026-25146.1In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring pCVE-2026-251407.5apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who coCVE-2026-251419.8Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and p