CVE-2026-9259

CriticalCVSS 9.8/10Last modified Jun 18, 2026

Description

Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published
Jun 16, 2026
Last modified
Jun 18, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-925905.4Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disablCVE-2026-925915.9Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installerCVE-2026-925928.8Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same CVE-2026-925938.8Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::rendCVE-2026-925947.5Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of reqCVE-2026-925955.9Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox optionsCVE-2026-925967.5Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to caCVE-2026-925976.5Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediatelyCVE-2026-925986.5Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to computeCVE-2026-925997.5joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in tCVE-2026-92609.8Use of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlierCVE-2026-926006.5Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints o
CVE-2026-9259: Critical severity, CVSS 9.8 | Vulnix