CVE-2026-6280

MediumCVSS 6.5/10Last modified Oct 25, 2026

Description

Exposure of sensitive information due to incompatible policies vulnerability in NOMYSOFT Informatics Education and Consulting Inc. Nomysem allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Nomysem: through 08072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-213

Affected software

VendorProductVersions
NOMYSOFT Informatics Education and Consulting Inc.Nomysem<= 08072026

References

Timeline

Published
Jul 8, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-628008.8Heap-based buffer overflow in Windows SMB Server allows an authorized attacker to execute code over a network.CVE-2026-628016.5Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypaCVE-2026-628037.8Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges loCVE-2026-628047.8External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-628077.8Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges loCVE-2026-62818.8A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the locCVE-2026-628107.8Heap-based buffer overflow in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.CVE-2026-628117.8Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.CVE-2026-628127.8Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges loCVE-2026-628137.5Use after free in Active Directory Domain Services allows an authorized attacker to execute code over a network.CVE-2026-628146.5Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent netwoCVE-2026-628159.8Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.