CVE-2026-92860

CriticalCVSS 9.1/10Last modified Sep 19, 2026

Description

A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. The attack may be performed from remote. Upgrading the affected component is advised.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Sep 17, 2026
Last modified
Sep 19, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-928615.1The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by theCVE-2026-928624.6The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to anCVE-2026-928678.7An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination oCVE-2026-928686.9An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificaCVE-2026-928697.1An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.CVE-2026-928708.7A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termiCVE-2026-928718.7A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of tCVE-2026-928725.3Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.CVE-2026-928736.9Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbCVE-2026-928745.4GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 thCVE-2026-928767.5IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to unconCVE-2026-928778.3The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP
CVE-2026-92860: Critical severity, CVSS 9.1 | Vulnix