CVE-2026-9642
critical
CVSS v3
9.8
CVSS v4 NEW
—
VIR risk
9.8
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
{**Immediate actions:**
1. Block the vulnerable endpoint at your reverse proxy or WAF:
```nginx
location ~ ^/api/db/ {
deny all;
return 403;
}
```
2. Restrict the database listener to localhost only. In DIAView config (`config/database.xml`):
```xml
<listener bind="127.0.0.1" port="5432" />
```
3. Restart DIAView service:
```bash
systemctl restart diaview
```
**Rollback:** Remove the nginx block and revert `database.xml` to original bind address. **Note:** This will break remote DB queries for legitimate integrations—coordinate with ops teams before applying. Test in staging first.}
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| deltaww | diaview | {"endIncluding":"4.4.0"} | |
References
CWEs
CWE-321
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.