CVE-2026-18749criticalCWE-639

CVE-2026-18749: falha crítica em CERT/CC VINCE

CVE-2026-18749

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar VINCE

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.5%
The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
CERT/CC · VINCE
CVEs relacionadas — CERT/CC VINCE

No mesmo produto, das mais perigosas para as menos.

CVE-2026-18744MEDIUMCVE-2026-18744EPSS 0.4%CVE-2026-18750MEDIUMCVE-2026-18750EPSS 0.3%CVE-2024-10469MEDIUMCERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.EPSS 0.2%CVE-2026-8142MEDIUMCVE-2026-8142EPSS 0.1%