CVE-2026-1696
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The web server does not properly set some HTTP security headers in responses sent to client applications. This can weaken protection against attacks such as XSS, clickjacking, and other threats due to missing security headers.
Risk Assessment
Missing proper HTTP security headers increases the risk of successful attacks on client applications, such as script injection or session hijacking, potentially leading to data breaches and loss of user trust.
Recommendation
Update the web server to the latest version that includes a fix for properly setting HTTP security headers. Additionally, configure Web Application Firewall (WAF) rules to enforce the required headers.
Other vulnerabilities in WebServer
See all- CVE-2026-22102Critical
A vulnerability in a web server allows arbitrary file writes via a POST request to a specific endpoint. The endpoint accepts the filename parameter in the Content-Disposition header without verification, enabling overwriting of system files or shell scripts.
- CVE-2026-22096Critical
The web server on port 8090 does not require authentication, allowing sensitive information leakage such as configured passwords and file uploads through various endpoints.
- CVE-2026-22095Critical
The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection. An attacker can remotely execute arbitrary system commands.
Original NVD description (English source)
Some HTTP security headers are not properly set by the web server when sending responses to the client application.