CVE-2026-70381

MediumCVSS 5.3/10Last modified Nov 2, 2026

Description

An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-290

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
WolfVision	Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro	< 1.78a
WolfVision	Cynap Pure (Next Gen), Cynap Bridge	< 2.00d
WolfVision	Cynap Videobar	< 1.72e
WolfVision	Cynap, Cynap Core, Cynap Pure SDM	0

References

https://wolfvision.com/de/security/cve-2026-70381-1

Timeline

Published: Oct 26, 2026
Last modified: Nov 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-703824.1Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker wh CVE-2026-703838.4Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA) CVE-2026-703868.5Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlu CVE-2026-703878.4Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes CVE-2026-703888.3SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cau CVE-2026-70397.8A security vulnerability has been detected in tufantunc ssh-mcp up to 1.5.0. The affected element is the function shell.write of the file sr CVE-2026-703952.1Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship CVE-2026-703965.4Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other reposi CVE-2026-703989.6A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authen CVE-2026-703998.7Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to ca CVE-2026-70407.5Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify CVE-2026-704005.4Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token