CVE-2026-77966

HighCVSS 8.8/10Last modified Sep 1, 2026

Description

The affected Ebyte

product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the device.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Aug 31, 2026
Last modified: Sep 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-779678.1The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association wit CVE-2026-779688.2A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. Wh CVE-2026-77977.5The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to time-based blind SQL In CVE-2026-779705.9Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated CVE-2026-779729.0Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach intern CVE-2026-779748.0After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through CVE-2026-779756.5The affected Ebyte product exports administrative credentials and other sensitive configuration information without adequate protection. CVE-2026-779778.1Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative acti CVE-2026-77985.4The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vuln CVE-2026-779879.8A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer va CVE-2026-779886.6A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. This vulnerability affects the function nvram_get of the component CLI Conf CVE-2026-779895.3Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - buildCurrentPdfLink cop