2 matches found
CVE-2026-82041
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...
9.9CVSS
SaveExploits0References3
EUVD-2026-91796
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...
6.5CVSS6.2AI score
SaveExploits0References3
20