CVE-2026-78528

MediumCVSS 5.3/10Last modified Sep 19, 2026

Description

Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Sep 17, 2026
Last modified
Sep 19, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-785299.8Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.CVE-2026-78539.8A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp of the component CVE-2026-785307.7Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.CVE-2026-785319.8Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.CVE-2026-785327.1Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.CVE-2026-785339.8Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.CVE-2026-785347.1Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.CVE-2026-785359.8Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.CVE-2026-785366.5Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.CVE-2026-78549.8A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the CVE-2026-785418.5A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacCVE-2026-785437.5IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1