rootpwn

critical · CVSS v3 10 · CVSS v4 10 · EPSS 0.0077

CVE-2026-105135

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the …

Description

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

Severity
critical
CVSS v2
10
CVSS v3
10
CVSS v4
10
EPSS
0.0077

← All CVEs

Related CVEs

critical

CVE-2026-105134

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.

View analysis

critical

CVE-2026-105123

A critical remote code execution flaw exists in Vincent Peugnet's WCMS (v3.18.0) that lets authenticated editors upload arbitrary files via the media upload API. The vulnerability allows path traversal to write files outside the media directory and delete arbitrary files, enabling execution of malicious PHP code. This flaw can be exploited by anyone with editor credentials to compromise the web server.

View analysis

critical

CVE-2026-88779

Citrix NetScaler ADC and Gateway are affected by a critical vulnerability that could allow attackers to compromise the confidentiality, integrity, and availability of network traffic and services. The flaw exists in versions prior to 14.1-73.41 and 13.1-64.28 for ADC, and similar pre‑release versions for Gateway. It is exploitable by remote actors with network access.

View analysis

critical

CVE-2026-103355

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

View analysis