CVE-2026-49292

InfoCVSS 0.0/10Last modified Sep 30, 2026

Description

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.

Metrics

CVSS 3.1 0.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 17, 2026
Last modified: Sep 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-492937.5js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 parse hexadecimal / oc CVE-2026-492946.1Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerabl CVE-2026-492957.1libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-b CVE-2026-492966.5Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. `CVE-2026-492978.1Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by th CVE-2026-492988.8A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to CVE-2026-492995.3In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defi CVE-2026-49307.1SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptographic operations (AES CVE-2026-493016.2Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentia CVE-2026-493026.2Permission control vulnerability in the notification service module. Impact: Successful exploitation of this vulnerability may affect servic CVE-2026-493035.1Permission control vulnerability in the notification module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-493046.2Permission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerability may affect avail