CVE-2026-113411Medium· 6.3▾ TwilightPoC availableA vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in impr…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
Exploit / PoC code exists
0.2% → 0.3%
A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 2.3.3 can resolve this issue. The patch is identified as f4df21bbc290f6c1956d899cf4da9e963074a6e4. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Desktop 2.2.0Desktop 2.2.1Desktop 2.2.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-66549Low· 2.4Nextcloud Desktop is the desktop sync client for Nextcloud
CVE-2026-119330Low· 3.5Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API
CVE-2026-112905Critical· 9.0Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft
CVE-2026-120224Critical· 9.9Oray Pugongying X5 Pro API Authorization run_async_task improper authorization
CVE-2025-10278Medium· 6.3YunaiV ruoyi-vue-pro transfer improper authorization
CVE-2025-10275Medium· 6.3YunaiV yudao-cloud transfer improper authorization