CVE-2026-43510
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
manage.get.gov is the .gov TLD registrar maintained by CISA, allowing an organization administrator to assign domain manager privileges for domains not already in another organization.
Risk Assessment
Lack of proper security in privilege assignment may lead to unauthorized access to domains, posing a risk to the organization.
Recommendation
It is recommended to upgrade to version 1.176.0 or later to mitigate this vulnerability.
Related vulnerabilities
- CVE-2026-81797Critical
The WordPress theme Buzz Stone | Magazine & Viral Blog in versions up to 1.0.2 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78535Critical
The WordPress theme Photolia in versions up to 1.0.3 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78533Critical
The WordPress theme Qwery in versions up to 3.6.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78531Critical
The WordPress theme Jacqueline in versions up to 2.22 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78529Critical
The WordPress theme Alliance in versions up to 3.11 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66569Critical
The WordPress theme Kicker in versions up to 2.2.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66568Critical
The WordPress theme Original in versions up to 1.9.0 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66567Critical
The WordPress theme Anesta in versions up to 1.5.3 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66565Critical
The WordPress theme FC United in versions up to 1.1.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66564Critical
The WordPress theme ShiftCV in versions up to 3.0.14 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
Original NVD description (English source)
manage.get.gov is the .gov TLD registrar maintained by CISA. manage.get.gov allows an organization administrator to assign domain manager privileges for domains not already in another organization. Fixed in 1.176.0 on or around 2026-04-30.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS