CVE-2026-87748

HighCVSS 8.8/10Last modified Sep 29, 2026

Description

Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse.

This issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
Interprobe Information Technologies Inc.Qorela DC>= 1.6.1-RC29, < v1.6.2

References

Timeline

Published
Sep 29, 2026
Last modified
Sep 29, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-87758.8A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component PCVE-2026-877526.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies TourCVE-2026-87755Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB CVE-2026-87756The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran wiCVE-2026-87758The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able CVE-2026-877598.8The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membershCVE-2026-87768.8A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSCVE-2026-877608.8The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visCVE-2026-877618.0The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticCVE-2026-877628.8The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, anCVE-2026-877648.8The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is CVE-2026-877655.5In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of
CVE-2026-87748: High severity, CVSS 8.8 | Vulnix