CVE-2026-57920
High · 7.7CVSS
7.7
EPSS
0.4%
Published
Jun 26, 2026
CISA due date
—
The record
Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-106579 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-551
- CVE-2026-16102 A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an… CWE-551
- CVE-2026-15573 A flaw was found in Keycloak's Authorization Services. CWE-551
- CVE-2026-13676 fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN)… CWE-551
- CVE-2026-50559 Quarkus is a Java framework for building cloud-native applications. CWE-551
- CVE-2026-44574 Next.js is a React framework for building full-stack web applications. CWE-551
- CVE-2026-44575 Next.js is a React framework for building full-stack web applications. CWE-551
- CVE-2026-44573 Next.js is a React framework for building full-stack web applications. CWE-551