CVE-2026-95721

LowCVSS 3.3/10Last modified Oct 23, 2026

Description

A memory corruption vulnerability exists in the web-based management interface of AOS-8. Successful exploitation could allow an authenticated low privilege attacker with local access to view some system files and interrupt the normal operation of the affected service.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-119

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 22, 2026
Last modified: Oct 23, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-95737.3A vulnerability was detected in itsourcecode Student Transcript Processing System 1.0. This affects an unknown part of the file /admin/modul CVE-2026-95747.3A flaw has been found in itsourcecode Student Transcript Processing System 1.0. This vulnerability affects unknown code of the file /admin/m CVE-2026-95757.3A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0. This issue affects some unknown processing of the f CVE-2026-957546.9In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentication) verification b CVE-2026-95764.9The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the CVE-2026-95774.8The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the CVE-2026-95796.3A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit o CVE-2026-95807.3A vulnerability was determined in JeecgBoot up to 3.9.1. The affected element is the function LoginController.selectDepart of the file /sys/CVE-2026-958055.3A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the perm CVE-2026-958067.7MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper caus CVE-2026-958076.4The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, CVE-2026-958087.5The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the