CVE-2026-5414

MediumCVSS 5.3/10Last modified Jul 24, 2026

Description

A security flaw has been discovered in Newgen OmniDocs up to 12.0.00. Affected by this issue is some unknown functionality of the file /omnidocs/WebApiRequestRedirection. The manipulation of the argument DocumentId results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-99

Affected software

No affected versions have been published.

Timeline

Published: Apr 2, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-541408.3OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descr CVE-2026-541419.0OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, a remote direct message recei CVE-2026-541428.7OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, background synchronization fo CVE-2026-541439.8OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.13, an attacker who can s CVE-2026-541446.1OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0 on macOS, the runtime injected CVE-2026-541458.8OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the appro CVE-2026-541468.8OpenHuman is an open-source agent harness available as a desktop application and Rust library. From 0.53.15 before 0.57.5 on macOS, core_pro CVE-2026-541476.5http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-CVE-2026-541488.1http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-CVE-2026-541498.8MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/serializers/tool.py CVE-2026-54158.8The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable CVE-2026-541506.9next-video is a library for adding video to Next.js applications. Prior to 2.8.1, the GET endpoint exported by next-video/request-handler an