CVE-2026-6901

HighCVSS 7.7/10Last modified Oct 25, 2026

Description

Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL.

This issue affects APROL: before R 4.4-01P5.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-426

Affected software

VendorProductVersions
B&R Industrial Automation GmbHAPROL< R 4.4-01P5

References

Timeline

Published
Jul 6, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-69027.7A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to addresCVE-2026-690257.5In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial oCVE-2026-69037.5The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality. An unauthCVE-2026-690439.1In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruptionCVE-2026-690448.4In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.CVE-2026-690509.8Out-of-bounds memory access in a device driver due to improper resource state tracking.CVE-2026-690668.4Memory corruption in GPU driver due to improper validation of VMID reservation.CVE-2026-690689.1Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.CVE-2026-69075.3An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requesCVE-2026-690756.9FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. PCVE-2026-690767.5Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed CVE-2026-690777.5Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly e
CVE-2026-6901: High severity, CVSS 7.7 | Vulnix