CVE-2026-8164

HighCVSS 7.3/10Last modified Oct 24, 2026

Description

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking.

This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
ArkSigner Software and Hardware Industry and Trade Inc.	ArkSigner Desktop Client	>= v2.2.16.10, <= 17062026

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0665

Timeline

Published: Jul 28, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-816408.8An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of t CVE-2026-816429.8In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possi CVE-2026-816432.3Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a subscriber is not auth CVE-2026-816444.3DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-816455.9Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability.CVE-2026-816465.9Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-816475.3Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-8164810.0The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing CVE-2026-816499.1The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying ins CVE-2026-816507.2The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from CVE-2026-816513.1The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing an CVE-2026-816522.7The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given ima