EUVD Vulnerability Catalog

EUVD-2026-31090

Severity: HIGH Base Score: 7.9 CVSS Version: 3.1

Vulnerability Description

Vendor disputed record. The reported behaviour is documented administrative functionality restricted to dedicated administrative permissions assigned by the operating hospital; its use by a permission holder is not a vulnerability. Unauthorised access to the functions is addressed under CVE-2026-0856. Improper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users' systems. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

▪ Attack Vector (AV): Adjacent Network

▪ Attack Complexity (AC): Low

▪ Privileges Required (PR): High

▪ User Interaction (UI): Required

▪ Scope (S): Changed

▪ Confidentiality Impact (C): High

▪ Integrity Impact (I): High

▪ Availability Impact (A): High

Affected Vendors & Systems

Vendor Mesalvo

References & Advisory Links

https://mesalvo.com/en/vdp/advisories/msa-2026-003.pdf

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

ENISA

EPSS Probability

0.28

Known Aliases

CVE-2026-22314 GHSA-xcwx-69fp-83wm

Published On

2026-05-20

Last Updated

2026-10-01