high · CVSS v3 6.3 · CVSS v4 5.3

CVE-2026-112102

A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file pa…

Description

A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Scores

Severity
high
CVSS v2
7.5
CVSS v3
6.3
CVSS v4
5.3
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-112107

A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis

high

CVE-2026-16460

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

View analysis

high

CVE-2026-74921

The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.

View analysis

high

CVE-2026-76740

A remote command execution flaw exists in HPE Compute Scale‑up Server 3200/3250 and Superdome Flex/Flex 280 RMC interfaces. Attackers can run arbitrary code on the RMC without authentication, potentially gaining full control over the server’s management plane.

View analysis