CVE-2026-7781

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in Open5GS up to 2.7.7. Affected by this issue is the function udm_nudm_uecm_handle_amf_registration_update of the file /src/udm/nudm-handler.c of the component amf-3gpp-access Endpoint. The manipulation leads to denial of service. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-404

Affected software

VendorProductVersions
n/aOpen5GS2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; 2.7.6; 2.7.7

References

Timeline

Published
May 4, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-778109.9In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplyiCVE-2026-778118.7Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permCVE-2026-778129.4DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a clientCVE-2026-778147.5is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), wCVE-2026-778157.5to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve syCVE-2026-778166.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attackeCVE-2026-778176.5IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitizatiCVE-2026-778186.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology ConsultiCVE-2026-778196.5IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation ofCVE-2026-77826.3A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1. This affects the function Clients::project of the file application/controCVE-2026-778206.4The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and CVE-2026-778229.6IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery