CVE-2026-41032

HighCVSS 7.5/10Last modified Jul 22, 2026

Description

It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jun 3, 2026
Last modified
Jul 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-410345.0ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and othCVE-2026-410357.8In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. TCVE-2026-410368.8This vulnerability exists in Quantum Networks router due to inadequate sanitization of user-supplied input in the management CLI interface. CVE-2026-410378.8This vulnerability exists in Quantum Networks router due to missing rate limiting and CAPTCHA protection for failed login attempts in the weCVE-2026-410388.8This vulnerability exists in Quantum Networks router due to lack of enforcement of strong password policies in the web-based management inteCVE-2026-410397.5This vulnerability exists in Quantum Networks router due to improper access control and insecure default configuration in the web-based manaCVE-2026-41049.8Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry and Trade Ltd. Co. TeknoCVE-2026-410408.7GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.CVE-2026-410419.1URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0CVE-2026-410429.1Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server CVE-2026-410436.5Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An autCVE-2026-410448.8Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broke
CVE-2026-41032: High severity, CVSS 7.5 | Vulnix