CVE-2026-94055

MediumCVSS 5.3/10Last modified Sep 24, 2026

Description

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Sep 19, 2026
Last modified
Sep 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-940567.5Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data fromCVE-2026-940575.3Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted dataCVE-2026-940587.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows ReflecteCVE-2026-940597.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows ReflecCVE-2026-94069.8A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setRemoteCfg of the file /cgi-bin/cstecgi.cCVE-2026-940607.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Voldor voldor allows ReflecCVE-2026-940617.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whiCVE-2026-940628.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes WerkstatCVE-2026-940637.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education alCVE-2026-940648.8Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue CVE-2026-940658.8Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: frCVE-2026-940667.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XS
CVE-2026-94055: Medium severity, CVSS 5.3 | Vulnix