CVE-2026-35555

MediumCVSS 6.3/10Last modified Oct 26, 2026

Description

PowerSYSTEM Center feature for device project groups allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Subnet SolutionsPowerSYSTEM Center 2024>= 6.0.x, <= 6.1.x
Subnet SolutionsPowerSYSTEM Center 20267.0.x

References

Timeline

Published
May 12, 2026
Last modified
Oct 26, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-355567.5OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access CVE-2026-355587.8Improper neutralization of special elements in the authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threaCVE-2026-355596.5Out-of-bounds write in the query processing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to crash the dCVE-2026-35568.8Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjaCVE-2026-355605.9Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a manCVE-2026-355619.8Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC driver before 2.1.0.0 migCVE-2026-355627.5Allocation of resources without limits in the parsing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to cCVE-2026-355638.5It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP CVE-2026-355655.4Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI Versions Affected: before 2.8.6 Description: The CVE-2026-355685.7MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a DNS rebinding CVE-2026-355698.7ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerabiCVE-2026-35578.0Philips Hue Bridge hap_pair_verify_handler Sub-TLV Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerabilit
CVE-2026-35555: Medium severity, CVSS 6.3 | Vulnix