CVE-2026-33583

HighCVSS 8.7/10Last modified Jun 17, 2026

Description

Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform.

This issue affects Symmetric Key Agreement Platform: before 26.03.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-749

Affected software

No affected versions have been published.

Timeline

Published
May 13, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-335845.3Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug informatiCVE-2026-335853.8Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an CVE-2026-335866.3Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail serCVE-2026-3358710.0Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) onCVE-2026-335888.1Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify filesCVE-2026-335896.5Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files conCVE-2026-33597.5The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inpuCVE-2026-335908.5Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code eCVE-2026-3359110.0A vulnerability in Wapt Server before version 2.6.1.17813 allows a  remote unauthenticated attacker to bypass security restriction using a sCVE-2026-335927.5An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FinCVE-2026-335937.5A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.CVE-2026-335947.5A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing querie