CVE-2026-111493

Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.

• CWE-306

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111487An out-of-bounds write vulnerability in the Qt Framework ass…4.3
• CVE-2026-111489A static credential embedded in the mobile app has been repo…9.9
• CVE-2026-11149Insufficient validation of untrusted input in Extensions in …7.5
• CVE-2026-111490Insecure direct object reference (IDOR) vulnerability in the…9.9
• CVE-2026-111491Credentials are stored in plain text in an SQLite database a…6.9
• CVE-2026-111492SQL injection in the push notification handler of the MatchP…8.6
• CVE-2026-111494Incorrect validation of TLS certificates in the MatchPoint A…9.1
• CVE-2026-111495API keys, credentials, and configuration parameters embedded…5.1
• CVE-2026-111496Kafka Streams derives its stream-time clock from record time…9.1
• CVE-2026-111497A buffer overflow vulnerability in the Brotli decoder (c/dec…9.8
• CVE-2026-111498OpenManage Enterprise, versions prior to 4.8.0, contains an …4.7
• CVE-2026-111499Dell OpenManage Enterprise, versions prior to 4.8.0, contain…5.5