CVE-2026-42095

MediumCVSS 4.0/10Last modified Oct 26, 2026

Description

bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
KDEArianna< 26.04.1

References

Timeline

Published
Apr 24, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-420968.8Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any CVE-2026-420978.8Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query parameter and send the model nCVE-2026-420988.7Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacCVE-2026-420997.5Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads the pCVE-2026-42109.8A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325CVE-2026-421007.5Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Denial of Service (DoS) attack to be executed by sendiCVE-2026-42119.8A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNSCVE-2026-42129.8A security vulnerability has been detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, CVE-2026-421277.5The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessCVE-2026-421297.7A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensiCVE-2026-42139.8A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-3CVE-2026-421376.5Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permission
CVE-2026-42095: Medium severity, CVSS 4.0 | Vulnix