CVE-2026-9300

MediumCVSS 6.3/10Last modified Jul 23, 2026

Description

A vulnerability has been found in omec-project amf up to 2.1.1. This affects an unknown part of the component NGSetupRequest Handler. Such manipulation leads to memory corruption. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. It is best practice to apply a patch to resolve this issue.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published
May 23, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-930006.8The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search fCVE-2026-930036.9The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A heCVE-2026-93016.3A vulnerability was found in omec-project amf up to 2.1.1. This vulnerability affects unknown code of the component NGReset Message Handler.CVE-2026-930129.8Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelCVE-2026-930134.3RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpointCVE-2026-930147.1RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users CVE-2026-930156.3BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery.CVE-2026-930177.7The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespCVE-2026-930185.5Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in CVE-2026-930199.1Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. The reaCVE-2026-93026.3A vulnerability was determined in 546669204 vps-inventory-monitoring up to 98c00b370668c96ae75e91c15548d9ea113652d9. This issue affects the CVE-2026-930266.1This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus upd