CVE-2026-70547

MediumCVSS 4.3/10Last modified Oct 24, 2026

Description

An authenticated user without repository read permission may access package metadata under specific conditions.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Aug 12, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-705483.5Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.CVE-2026-70558.8A security vulnerability has been detected in Tenda F456 1.0.0.5. This issue affects the function fromVirtualSer of the file /goform/VirtualCVE-2026-705506.5An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to rCVE-2026-705518.5A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.CVE-2026-705529.8MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers tCVE-2026-705539.8MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the appliCVE-2026-705549.8MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attackeCVE-2026-705564.3Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\MoCVE-2026-705576.5diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returCVE-2026-705589.8Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path) and file.transferTo(CVE-2026-705597.5Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits tCVE-2026-70568.8A vulnerability was detected in Tenda F456 1.0.0.5. Impacted is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter of the comp
CVE-2026-70547: Medium severity, CVSS 4.3 | Vulnix