high · CVSS v3 7.3 · CVSS v4 8.5 · EPSS 0.00073

CVE-2026-112161

MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity.…

Description

MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.

Scores

Severity
high
CVSS v2
4.4
CVSS v3
7.3
CVSS v4
8.5
EPSS
0.00073

← All CVEs

Related CVEs

high

CVE-2026-112107

A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis

high

CVE-2026-108121

CVE-2026-108121 is a high‑severity flaw in SME Server 11.0rc1‑215 that lets a privileged user inject Apache directives during domain creation. The injected directives corrupt httpd.conf, causing Apache to fail to start after reboot and leading to a denial‑of‑service of the web server and its virtual hosts. The issue is exploitable only by users with high privileges on the host.

View analysis

high

CVE-2026-112081

A deserialization flaw in HanLP’s load function allows remote attackers to supply a crafted classpath argument, potentially leading to arbitrary code execution. The issue affects all versions up to 2.1.0-beta.64 and can be triggered via network interfaces. It has been publicly disclosed and remains unpatched.

View analysis

high

CVE-2026-112082

The CVE-2026-112082 vulnerability affects the SGLang library (up to version 0.5.19) in the Expert‑Distribution Recording Endpoint. It allows remote attackers to trigger a denial‑of‑service by manipulating the Scheduler.expert_distribution_handle function. The flaw is publicly documented and the fix is pending merge.

View analysis