CVE-2026-87748

HighCVSS 8.8/10Last modified Sep 29, 2026

Description

Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse.

This issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Sep 29, 2026
Last modified
Sep 29, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-87758.8A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component PCVE-2026-877526.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies TourCVE-2026-877598.8The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membershCVE-2026-87768.8A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSCVE-2026-877608.8The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visCVE-2026-877618.0The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticCVE-2026-877628.8The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, anCVE-2026-877648.8The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is CVE-2026-877655.5In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of CVE-2026-877668.8A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the CVE-2026-877678.6The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQCVE-2026-87776.3A vulnerability was found in Edimax BR-6428NS 1.10. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of t
CVE-2026-87748: High severity, CVSS 8.8 | Vulnix