CVE-2026-64630

MediumCVSS 5.3/10Last modified Oct 24, 2026

Description

A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.

Metrics

CVSS 4.0 5.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 4, 2026
Last modified
Oct 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-646318.6A vulnerability allowing a low-privileged user to inject SQL and extract database contents.CVE-2026-646328.5A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.CVE-2026-6463310.0A vulnerability allowing remote unauthenticated code execution on the agent host.CVE-2026-646348.4A vulnerability allowing local privilege escalation to the Reporter service context.CVE-2026-646355.3Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attCVE-2026-646367.7An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data froCVE-2026-646379.9Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative sessiCVE-2026-646388.9WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party websCVE-2026-646399.3Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) toCVE-2026-64648.1Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via erCVE-2026-646406.5Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal withCVE-2026-646417.5Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafte
CVE-2026-64630: Medium severity, CVSS 5.3 | Vulnix