CVE-2026-39454

SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder with improper file access permission settings. A non-administrative user may manipulate and/or place arbitrary files within the installation folder of the product. As a result, arbitrary code may be executed with the administrative privilege.

• CWE-276
• CWE-863

• https://jvn.jp/en/jp/JVN63376363/Third Party Advisory
• https://www.skyseaclientview.net/news/260420_01/Vendor Advisory

Published

Apr 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39448Unauthenticated Broken Access Control in NOWPayments for Woo…7.5
• CVE-2026-39449Unauthenticated Cross Site Scripting (XSS) in Contact Form t…7.1
• CVE-2026-3945An integer overflow vulnerability in the HTTP chunked transf…8.7
• CVE-2026-39450Subscriber Broken Authentication in FunnelKit Automations <=…7.1
• CVE-2026-39451Unauthenticated Cross Site Scripting (XSS) in WP Google Revi…6.3
• CVE-2026-39452Protection mechanism failure for some Intel(R) Transfer Lear…6.3
• CVE-2026-39455When the BIG-IP Configuration utility is configured to use L…8.7
• CVE-2026-39457When exchanging data over a socket, libnv uses select(2) to …7.8
• CVE-2026-39458When a BIG-IP DNS profile enabled with DNS cache is configur…8.7
• CVE-2026-39459A vulnerability exists in iControl REST and the TMOS Shell (…8.6
• CVE-2026-3946A vulnerability was detected in PHPEMS 11.0. The affected el…3.5
• CVE-2026-39461libcasper(3) communicates with helper processes via UNIX dom…8.8