CVE-2026-2556

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in cskefu up to 8.0.1. This issue affects some unknown processing of the file com/cskefu/cc/controller/resource/MediaController.java of the component Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Feb 16, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-255609.8WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporCVE-2026-255617.5WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided iCVE-2026-255624.3WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be retuCVE-2026-255637.5WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implCVE-2026-255647.5WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implCVE-2026-255656.5WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rathCVE-2026-255665.4WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic. A user can specify a destination board/list/swimlaneCVE-2026-255674.3WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an auCVE-2026-255684.3WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sCVE-2026-255697.8A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). An out-of-bounds write vulnerability exists in SICAM SIAPP SCVE-2026-25575.4A vulnerability was detected in cskefu up to 8.0.1. Impacted is the function Upload of the file com/cskefu/cc/controller/resource/MediaContrCVE-2026-255707.8A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The SICAM SIAPP SDK does not perform checks on input values
CVE-2026-2556: Medium severity, CVSS 6.3 | Vulnix