CVE-2026-8287

MediumCVSS 4.3/10Last modified Oct 24, 2026

Description

Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software allows Excessive Allocation.

This issue affects Online Pre-Accounting Software: through 17072026.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

VendorProductVersions
BizimHesap Information Systems Industry and Trade Inc.Online Pre-Accounting Software<= 17072026

References

Timeline

Published
Jul 23, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-828709.6ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to CVE-2026-828717.7ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other CVE-2026-828729.1ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJetCVE-2026-828735.0ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint that allow autheCVE-2026-828749.9ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameteCVE-2026-828755.5ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URCVE-2026-828768.2Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than aCVE-2026-828776.5ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticatCVE-2026-828786.3DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST CVE-2026-828796.3DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID,CVE-2026-82886.5A vulnerability was determined in Open5GS up to 2.7.7. This affects the function gsm_handle_pdu_session_modification_qos_flow_descriptions oCVE-2026-828807.5YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail
CVE-2026-8287: Medium severity, CVSS 4.3 | Vulnix