CVE-2026-92860

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92860
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92860.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92860
Aliases
  • GHSA-rr3f-jjrr-3qxv
Published
2026-09-17T12:00:15Z
Modified
2026-09-20T11:31:02Z
Severity
  • 9.4 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X CVSS Calculator
Summary
rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validation
Details

A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. The attack may be performed from remote. Upgrading the affected component is advised.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-20"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92860.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "6.1.0-rc.0"
                },
                {
                    "last_affected":  "6.1.0-rc.0"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/rcourtman/pulse

Affected ranges

Type
GIT
Repo
https://github.com/rcourtman/pulse
Events
Introduced
6bdb3c9c8c2bb35b3a9bd2fc4d07c29f171f26e6
Fixed
e1f33c1bad6831ea00a2824b39d259fb8a071508
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "6.0.0"
        },
        {
            "last_affected":  "6.0.0"
        },
        {
            "introduced":  "6.0.1"
        },
        {
            "last_affected":  "6.0.1"
        },
        {
            "introduced":  "6.0.2"
        },
        {
            "last_affected":  "6.0.2"
        },
        {
            "introduced":  "6.0.3"
        },
        {
            "last_affected":  "6.0.3"
        },
        {
            "introduced":  "6.0.4"
        },
        {
            "last_affected":  "6.0.4"
        },
        {
            "introduced":  "6.1.0-rc.1"
        },
        {
            "last_affected":  "6.1.0-rc.1"
        },
        {
            "introduced":  "6.1.0-rc.2"
        },
        {
            "last_affected":  "6.1.0-rc.2"
        },
        {
            "introduced":  "6.1.0-rc.3"
        },
        {
            "last_affected":  "6.1.0-rc.3"
        },
        {
            "introduced":  "6.1.0-rc.4"
        },
        {
            "last_affected":  "6.1.0-rc.4"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

6.*
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.1.0-rc.1
6.1.0-rc.2
6.1.0-rc.3
6.1.0-rc.4
helm-chart-6.*
helm-chart-6.0.1
helm-chart-6.0.4
helm-chart-6.0.5
helm-chart-6.0.5-rc.1
helm-chart-6.0.5-rc.2
helm-chart-6.0.5-rc.3
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.0.3
v6.0.4
v6.0.4-rc.1
v6.0.4-rc.2
v6.0.5
v6.0.5-rc.1
v6.0.5-rc.2
v6.0.5-rc.3
v6.0.5-rc.4
v6.1.0-rc.1
v6.1.0-rc.2
v6.1.0-rc.3
v6.1.0-rc.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92860.json"