CVE-2026-115994

Published Oct 24, 2026

Last updated 16 hours ago

CVSS medium 5.4

Overview

Description
BOLA Allows Cross-Project Target Tampering  in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.
Source
772f0079-75c2-41ca-913e-d9072716578b
NVD status
Received

Risk scores

CVSS 3.1

Type
Secondary
Base score
5.4
Impact score
2.5
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Severity
MEDIUM

Weaknesses

772f0079-75c2-41ca-913e-d9072716578b
CWE-639

Social media

Hype score
Not currently trending

References

Sources include official advisories and independent security research.