CVE-2026-2250
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Feb 11, 2026
CISA due date
—
The record
The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mode enabled, causing malformed requests to return verbose Django tracebacks that disclose backend source code, local file paths, and system configuration.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-79694 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-215
- CVE-2026-62652 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). CWE-215
- CVE-2026-74799 SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and… CWE-215
- CVE-2026-44934 A information disclosure when DEBUG loglevel is set in SUSE Rancher AI Agent 1.0 before… CWE-215
- CVE-2026-33247 NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging… CWE-215
- CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-284
- CVE-2026-83395 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-284
- CVE-2026-112091 A flaw has been found in Dav-ee dairy-management-system… CWE-284