rootpwn

high · CVSS v3 7.3 · CVSS v4 6.9

CVE-2026-105148

A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shar…

Description

A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval Completion API Endpoint. Such manipulation of the argument generation_config.api_base leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.3
CVSS v4
6.9
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-88782

The Kubio AI Page Builder WordPress plugin (v<2.9.3) fails to validate URI schemes in user-supplied link targets, enabling stored XSS. Contributors and higher can inject malicious payloads that execute in the browsers of anyone who clicks the link, including administrators previewing drafts. This flaw can lead to session hijacking or defacement.

View analysis

high

CVE-2026-97935

A use‑after‑free bug in the Linux kernel tracing subsystem allows a malformed histogram trigger to corrupt the named_triggers list. The flaw occurs when an invalid clock string is supplied, causing the trigger to be registered before the clock is validated. This can lead to kernel memory corruption and potential privilege escalation.

View analysis

high

CVE-2026-105126

LaraDashboard versions before 1.4.8 have a privilege escalation flaw that lets authenticated Admin users gain Superadmin rights by editing or renaming roles. This allows attackers to access core upgrade and module installation functions, potentially leading to code execution. The vulnerability is exploitable by users with role.edit permissions.

View analysis

high

CVE-2026-105129

LaraDashboard before 1.4.8 contains an authorization flaw that allows users with only settings.view permission to read sensitive secrets via the settings API. This exposes AI provider keys, mail credentials, passwords, and tokens to any authenticated user. The vulnerability can be exploited by any user who has logged in.

View analysis