CVE-2026-80337

MediumCVSS 5.3/10Last modified Oct 2, 2026

Description

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Oct 2, 2026
Last modified
Oct 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-803386.8The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low CVE-2026-803395.3The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JaCVE-2026-80349.8A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker tCVE-2026-803405.3The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JaCVE-2026-803415.9The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user aCVE-2026-803426.5The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request CVE-2026-803438.2Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 befCVE-2026-803448.2Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, CVE-2026-803467.1StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthCVE-2026-803477.5mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostCVE-2026-803488.8TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patCVE-2026-803499.8TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true
CVE-2026-80337: Medium severity, CVSS 5.3 | Vulnix