CVE-2026-42951

MediumCVSS 5.4/10Last modified Jul 21, 2026

Description

An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder

device which includes account data and password hashes.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published
May 29, 2026
Last modified
Jul 21, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-429527.5Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to CVE-2026-429538.4The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program to write data past tCVE-2026-429553.7In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family oCVE-2026-429587.8The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted filCVE-2026-429597.5NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crashCVE-2026-42968.8An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect UCVE-2026-4296010.0NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. PromiscuCVE-2026-429615.1ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views aCVE-2026-429656.5A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backedCVE-2026-429685.5Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally.CVE-2026-429695.5Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.CVE-2026-42978.8The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. T
CVE-2026-42951: Medium severity, CVSS 5.4 | Vulnix