CVE-2026-3563
Medium · 5.5CVSS
5.5
EPSS
0.4%
Published
Mar 17, 2026
CISA due date
—
The record
Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or Endpoints to override existing application or system routes, resulting in unintended request routing and denial of service via a conflicting URL path.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. CWE-1289
- CVE-2026-89049 A server-side request forgery issue due to improper validation of equivalent address… CWE-1289
- CVE-2026-76977 SAP UI5 does not sufficiently validate the parent frame's origin against the configured… CWE-1289
- CVE-2026-74994 The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia… CWE-1289
- CVE-2026-19953 URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode… CWE-1289
- CVE-2026-60074 Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal… CWE-1289
- CVE-2026-42462 Fedify is a TypeScript library for building federated server apps powered by ActivityPub. CWE-1289
- GHSA-xrhx-7g5j-rcj5 Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 CWE-1289