CVE-2026-26236

HighCVSS 7.5/10Last modified Jul 23, 2026

Description

A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions.

We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-262377.5A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access CVE-2026-262398.1A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit CVE-2026-26249.8Missing Authentication for Critical Function vulnerability in ePati Cyber Security Technologies Inc. Antikor Next Generation Firewall (NGF CVE-2026-262409.1A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modif CVE-2026-262419.1A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modif CVE-2026-262437.2A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit t CVE-2026-262448.8A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit th CVE-2026-262458.8A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit th CVE-2026-262464.3Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files CVE-2026-262479.1Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange wi CVE-2026-26255.5A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (R CVE-2026-26268.1The divi-booster WordPress plugin before 5.0.2 does not have authorization and CSRF checks in one of its fixing function, allowing unauthent