CVE-2026-5618

MediumCVSS 5.6/10Last modified Jul 24, 2026

Description

A vulnerability was detected in kalcaddle kodbox up to 1.64. This affects an unknown function of the component shareMake/shareCheck. Performing a manipulation of the argument siteFrom/siteTo results in server-side request forgery. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2026
Last modified
Jul 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-561818.3Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent neCVE-2026-561827.8Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-561837.0Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.CVE-2026-561845.5Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally.CVE-2026-561856.5Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network.CVE-2026-561866.5Out-of-bounds read in Windows Schannel allows an authorized attacker to disclose information over a network.CVE-2026-561877.8Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.CVE-2026-561888.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unautCVE-2026-561898.4Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.CVE-2026-56195.3A flaw has been found in Braffolk mcp-summarization-functions up to 0.1.5. This impacts an unknown function of the file src/server/mcp-serveCVE-2026-561909.8Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.CVE-2026-5619110.0Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
CVE-2026-5618: Medium severity, CVSS 5.6 | Vulnix