CVE-2026-9645

CriticalCVSS 9.9/10Last modified Aug 17, 2026

Description

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: May 28, 2026
Last modified: Aug 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-964505.4Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.CVE-2026-964518.8Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalatio CVE-2026-964548.2Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream templ CVE-2026-964558.8The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daem CVE-2026-964566.3The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not CVE-2026-96466.1A reflected cross-site scripting issue exists in URL handling.CVE-2026-964617.5Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2026-96489.1The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subjec CVE-2026-96507.5CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when u CVE-2026-96514.4CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and CVE-2026-965127.8A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing CVE-2026-965137.3A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php