CWE-183

CWE-183 · 9 records · 6 with a public proof-of-concept

Records the NVD classes under CWE-183, highest CVSS first.

  1. HIGH 8.1CVE-2026-115915public PoC2026-10-26

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the…

    vllm

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 7.7CVE-2026-106510public PoC2026-10-07

    Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register cata…

    backstage plugin-techdocs-node · backstage

    AI risk analysis on Exploit-DB.ai →

  3. HIGH 7.3CVE-2026-116339public PoC2026-10-26

    A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be in…

    AI risk analysis on Exploit-DB.ai →

  4. HIGH 7.3CVE-2026-103687public PoC2026-10-01

    A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the at…

    AI risk analysis on Exploit-DB.ai →

  5. MEDIUM 6.5CVE-2026-962292026-10-13

    Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.

    AI risk analysis on Exploit-DB.ai →

  6. MEDIUM 5.2CVE-2026-117570public PoC2026-10-27

    Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos,…

    AI risk analysis on Exploit-DB.ai →

  7. MEDIUM 4.4CVE-2026-891062026-10-13

    SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and i…

    AI risk analysis on Exploit-DB.ai →

  8. UNSCOREDCVE-2026-113786public PoC2026-10-21

    pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environm…

    AI risk analysis on Exploit-DB.ai →

  9. UNSCOREDCVE-2026-129742026-09-23

    A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW). This issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through 7.1.13, from 7.3.0 through 7.3.1, 7.3.3, from 7.4.0 through 7.4.1, and 7.5.0.

    AI risk analysis on Exploit-DB.ai →