CVE-2026-94588

MediumCVSS 4.4/10Last modified Sep 24, 2026

Description

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in a CSRF-style attack.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-88

Affected software

No affected versions have been published.

Timeline

Published: Sep 21, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-945899.8The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Up CVE-2026-94598.8A security flaw has been discovered in Edimax EW-7438RPn 1.31. This affects the function formConnectionSetting of the file /goform/formConne CVE-2026-945906.5Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of CVE-2026-945918.4Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this pro CVE-2026-945928.4Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, CVE-2026-945937.8Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a CVE-2026-945944.0Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any part CVE-2026-94608.8A weakness has been identified in Edimax EW-7438RPn 1.31. This impacts the function formAccept of the file /goform/formAccept. Executing a m CVE-2026-9460310.0Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.a CVE-2026-946068.9authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an CVE-2026-946098.8authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a g CVE-2026-94618.8A security vulnerability has been detected in Edimax EW-7438RPn 1.31. Affected is the function formRadius of the file /goform/formRadius. Th