CVE-2026-76137

LowCVSS 3.3/10Last modified Oct 18, 2026

Description

Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Aug 21, 2026
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-761398.0A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifCVE-2026-76144.3The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. ThisCVE-2026-761429.3Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unautheCVE-2026-761437.3A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login reqCVE-2026-761441.8An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL PNS allows an attacCVE-2026-761457.5An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force CVE-2026-761468.4An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to exeCVE-2026-761475.9A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of GeCVE-2026-761488.4CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.CVE-2026-761494.6CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file.CVE-2026-76154.3The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3. This is dueCVE-2026-761514.6Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through