CVE-2026-67578

HighCVSS 7.5/10Last modified Aug 28, 2026

Description

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Aug 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-675797.4Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through CVE-2026-67587.5Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.CVE-2026-675817.5Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one CVE-2026-675858.7Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthenticated remote attack CVE-2026-675878.8Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by CVE-2026-675887.5A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This CVE-2026-675897.5A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. CVE-2026-67597.5Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunder CVE-2026-675907.5A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issu CVE-2026-675916.5An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affect CVE-2026-675927.5It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause exces CVE-2026-675939.1A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the con