All vulnerabilities
CVE-2026-107092

NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.

n/a n/a
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 26 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Timeline

  1. 23 Oct 2026, 10:46 UTCExploit code publicGitHub proof-of-concept repositories
  2. 26 Oct 2026, 00:00 UTCPublishedCVE List

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Affected versions 1

  • n/aaffected: n/aCVE List

References 1