CVE-2026-7187

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects UKBS: through 28072026. NOTE: The vendor was contacted and it was learned that the product is not supported.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Universal Software Inc.	UKBS	<= 28072026

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0664

Timeline

Published: Jul 28, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-718703.3pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.CVE-2026-718719.3Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expressi CVE-2026-718789.2Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit ve CVE-2026-718799.1Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before CVE-2026-71889.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Armiya Information Technologies Ltd. C CVE-2026-718807.6Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated CVE-2026-718838.2In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the ca CVE-2026-718848.2In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the CVE-2026-718859.2In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a Lea CVE-2026-718868.2In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from CVE-2026-718878.2In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding si CVE-2026-718888.7In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fie