CVE-2026-121xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

5 records · Page 1 of 1

• CVE-2026-121024: Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet 5.3 Medium

  Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API.

  Updated 2026-11-03
• CVE-2026-121023: LDAP Bind Password Exposure in AxxonNet ARP Agent Logs 6.8 Medium

  Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft AxxonNet before 3.25.0 on Windows and Linux allows a local attacker with read access to ARP Agent log files or support packages to obtain the plaintext password of the LDAP directory service account via WARNING-level log entries that contain serialized user synchronization data.

  Updated 2026-11-03
• CVE-2026-121022: Default Administrator Password Change Not Enforced in Axxon One Web Client 9.2 Critical

  Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.

  Updated 2026-11-03
• CVE-2026-121021: Plaintext Storage of LDAP Password in Axxon One Shared Configuration 6.8 Medium

  Plaintext Storage of a Password (CWE-256) in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration backups to obtain the password of the LDAP directory service account via the main.conf configuration file.

  Updated 2026-11-03
• CVE-2026-121020: User and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration API 5.3 Medium

  Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's

  Updated 2026-11-03

Search a CVE ID or check dependency files →