CVE-2026-42950

MediumCVSS 5.1/10Last modified Jun 17, 2026

Description

ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken.

Metrics

CVSS 4.0 5.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-754

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-429515.4An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password CVE-2026-429527.5Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to CVE-2026-429538.4The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program to write data past t CVE-2026-429553.7In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family o CVE-2026-429587.8The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted fil CVE-2026-429597.5NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash CVE-2026-42968.8An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect U CVE-2026-4296010.0NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscu CVE-2026-429615.1ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a CVE-2026-429656.5A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed CVE-2026-429685.5Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally.CVE-2026-429695.5Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.