CVE-2026-6902

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security risks.

Metrics

CVSS 4.0 7.7/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: May 18, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-69037.5The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality. An unauth CVE-2026-69075.3An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches reques CVE-2026-690756.9FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. P CVE-2026-690767.5Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed CVE-2026-690777.5Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly e CVE-2026-690788.8CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-contro CVE-2026-690798.7CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint a CVE-2026-690807.5Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4.CVE-2026-690828.8CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/<i CVE-2026-6908310.0SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated CVE-2026-6908410.0SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the mai CVE-2026-6908510.0SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword para