CVE-2026-5413

LowCVSS 3.7/10Last modified Jul 24, 2026

Description

A vulnerability was identified in Newgen OmniDocs up to 12.0.00. Affected by this vulnerability is an unknown functionality of the file /omnidocs/GetWebApiConfiguration. The manipulation of the argument connectionDetails leads to information disclosure. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Apr 2, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-541307.5Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.CVE-2026-541317.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-541326.8Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-541339.8jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applic CVE-2026-541347.0OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload han CVE-2026-541357.5AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in th CVE-2026-541365.1Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scop CVE-2026-54145.3A security flaw has been discovered in Newgen OmniDocs up to 12.0.00. Affected by this issue is some unknown functionality of the file /omni CVE-2026-541476.5http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-CVE-2026-541488.1http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-CVE-2026-541498.8MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/serializers/tool.py CVE-2026-54158.8The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable