CVE-2026-40462

MediumCVSS 6.5/10Last modified Jun 29, 2026

Description

Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
May 13, 2026
Last modified
Jun 29, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-404637.6WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allowCVE-2026-404645.4NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authentiCVE-2026-404655.3NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter.CVE-2026-404668.8Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMCVE-2026-404677.5Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It CVE-2026-404689.1Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting oCVE-2026-404699.1Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite CVE-2026-404709.9A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via CVE-2026-404719.6hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to CVE-2026-404729.9In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling sCVE-2026-404738.8The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without appCVE-2026-404747.6wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = '