CVE-2026-78310

MediumCVSS 4.3/10Last modified Sep 24, 2026

Description

Authorization Bypass Through User-Controlled Key in DIAEnergie.

This issue affects DIAEnergie: before 1.11.00.022.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
DeltawwDIAEnergie< 1.11.00.022

References

Timeline

Published
Sep 24, 2026
Last modified
Sep 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-783118.8SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.CVE-2026-783129.1Path Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.CVE-2026-783136.5Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.CVE-2026-783148.8SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.CVE-2026-783158.8SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.CVE-2026-783168.8SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.CVE-2026-783178.8SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.CVE-2026-783186.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope. The notification meCVE-2026-783199.3A service running on the affected products contains a potential Time-of-Check Time-of-Use (TOCTOU) race condition. An unauthenticated remoteCVE-2026-78327.0A security flaw has been discovered in IObit Advanced SystemCare 19. This affects an unknown part of the file ASC.exe of the component ServiCVE-2026-783216.0The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to CVE-2026-783226.5A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long p
CVE-2026-78310: Medium severity, CVSS 4.3 | Vulnix