CVE-2026-97231

HighCVSS 7.3/10Last modified Sep 29, 2026

Description

A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. Affected is an unknown function of the file app.py of the component Socket.IO Connect Interface. The manipulation results in missing authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-287 CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Sep 24, 2026
Last modified: Sep 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-972326.3A vulnerability was determined in volotat Anagnorisis up to 0.4.2. Affected by this vulnerability is the function get_file_content/save_file CVE-2026-972333.5A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.CVE-2026-972357.1Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.CVE-2026-972366.5Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.CVE-2026-972377.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows CVE-2026-972385.5Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.CVE-2026-972396.5Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.CVE-2026-97244.3The MotorDesk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to m CVE-2026-972407.5Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.CVE-2026-972417.5Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.CVE-2026-972426.8Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.CVE-2026-972435.4Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.