CVE-2026-32772

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-669

Affected software

No affected versions have been published.

Timeline

Published
Mar 16, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-327736.1There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescapeCVE-2026-327745.4Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject maliciousCVE-2026-327757.8libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-bCVE-2026-327765.5libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.CVE-2026-327775.5libexpat before 2.7.5 allows an infinite loop while parsing DTD content.CVE-2026-327785.5libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.CVE-2026-32786.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ ZENworks Service Desk allowsCVE-2026-327886.7Uncontrolled search path for some Approximate Bayesian Inference Framework before version on commit #484c949 within Ring 3: User ApplicationCVE-2026-32796.5The Enable jQuery Migrate Helper plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check oCVE-2026-327917.0Untrusted search path for some Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 within Ring 3: User ApplicationCVE-2026-327925.3NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enCVE-2026-327944.8Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for con
CVE-2026-32772: Medium severity, CVSS 4.7 | Vulnix