CVE-2026-55979

MediumCVSS 5.2/10Last modified Oct 24, 2026

Description

An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. This is limited to operations that enforce more restrictive security policies.

Metrics

CVSS 3.1 5.2/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
SecureAge	CatchPulse	10.10.0 and earlier

References

Timeline

Published: Aug 6, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-55987.5Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associat CVE-2026-559805.5A denial-of-service vulnerability in CatchPulse could allow an attacker to conduct a stack buffer overrun attack, leading to a denial-of-ser CVE-2026-559819.6A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upl CVE-2026-559829.1OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes CVE-2026-559842.7Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service CVE-2026-559854.3The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configura CVE-2026-559865.4Email Management API Bypasses ManageCredentials Feature Restrictions CVE-2026-559878.1OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)CVE-2026-55997.3A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.CVE-2026-559905.9In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there ar CVE-2026-559915.9In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with CVE-2026-559937.5Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in A