{"id":"CVE-2026-94380","aliases":[],"title":"Host Header Injection in HAVELSAN's Liman MYS","titleSource":"TR-CERT","descriptionSource":"TR-CERT","products":[{"vendor":"HAVELSAN Inc.","name":"Liman MYS","platforms":[],"versions":[{"version":"2.3.4-1124","status":"affected","lessThan":"2.3.5-1131","versionType":"semver"}],"defaultStatus":"unaffected","source":"TR-CERT","url":"https://www.cve.org/CVERecord?id=CVE-2026-94380"}],"remediation":[],"description":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation.\n\nThis issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.","severity":"high","score":8.1,"published":"2026-10-26T11:15:45.141Z","modified":"2026-10-26T14:35:18.248Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1396"],"sources":[{"name":"CVE","id":"CVE-2026-94380","modified":"2026-10-26T14:35:18.248Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-94380"}],"assessments":[{"source":"TR-CERT","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":8.1}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T03:10:35.950Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}