CVE-2026-81302

HighCVSS 8.5/10Last modified Sep 8, 2026

Description

PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the affected product.

Metrics

CVSS 4.0 8.5/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Sep 4, 2026
Last modified: Sep 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-813036.3A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spe CVE-2026-813056.8CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An atta CVE-2026-81317.3A security flaw has been discovered in SourceCodester SUP Online Shopping 1.0. This impacts an unknown function of the file /admin/replymsg.CVE-2026-813106.6Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is in CVE-2026-813157.4Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection CVE-2026-813162.1Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restric CVE-2026-813182.1Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate CVE-2026-813195.9Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted colu CVE-2026-81327.3A weakness has been identified in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /login.php. This manipu CVE-2026-813205.5A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the CVE-2026-813219.8CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesyste CVE-2026-813222.1Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error t