CVE-2026-6981

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in IhateCreatingUserNames2 AiraHub2 up to 3e4b77fd7d48ed811ffe5b8d222068c17c76495e. Affected is the function connect_stream_endpoint/sync_agents of the file AiraHub.py of the component Endpoint. Performing a manipulation results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Apr 25, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-698138.1Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.CVE-2026-698147.0Use after free in Windows Credential Providers allows an authorized attacker to elevate privileges locally.CVE-2026-698167.0Use after free in Windows Accounts Control allows an authorized attacker to elevate privileges locally.CVE-2026-698177.0Use after free in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.CVE-2026-698187.0Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-698199.8Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network.CVE-2026-69826.3A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0. Affected by this vulnerability is an unknown functionality of tCVE-2026-698206.7Heap-based buffer overflow in Windows Hello allows an authorized attacker to elevate privileges locally.CVE-2026-698217.8Improper encoding or escaping of output in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privilegesCVE-2026-698227.8Numeric truncation error in Windows Kerberos allows an authorized attacker to elevate privileges locally.CVE-2026-698249.8Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an unauthorized attacker to execute code over a network.CVE-2026-698268.0Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges over a network.
CVE-2026-6981: Medium severity, CVSS 6.3 | Vulnix