CVE-2026-7766

HighCVSS 8.3/10Last modified Jul 23, 2026

Description

Kenik Camera management Panel is vulnerable to Path Traversal vulnerability. An unauthenticated attacker can send GET request with arbitrary file path and read corresponding files located on the server.

The issue was fixed in version 2026-04-23 of the KG-5260xxxx-IL-(G)2 cameras. Rest of the products were fixed in version 2025-04-21.

Metrics

CVSS 4.0 8.3/10CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
KenikKG-5230TAS-IL-3< 2025-04-21
KenikKG-5230TAS-IL-G3< 2025-04-21
KenikKG-5230DAS-IL-G3< 2025-04-21
KenikKG-5260TZAS-IL-3< 2025-04-21
KenikKG-5260DZAS-IL-3< 2025-04-21
KenikKG-5260TZAS-IL-G3< 2025-04-21
KenikKG-5260DZAS-IL-G3< 2025-04-21
KenikKG-5260xxxx-IL-(G)2< 2026-04-23

References

Timeline

Published
May 25, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-77675.8GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 tCVE-2026-77687.5@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. CVE-2026-776805.3An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 CVE-2026-776816.3A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /uCVE-2026-776839.9A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-confCVE-2026-776845.7The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are CVE-2026-776858.3The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BT_RFCOMM_TEST commaCVE-2026-776865.4A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component AccoCVE-2026-776895.3The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recCVE-2026-77698.1IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File GatewaCVE-2026-776908.8ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated CVE-2026-776918.1ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft