medium · CVSS v3 5.5

CVE-2026-59010

In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to loc…

Description

In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Scores

Severity
medium
CVSS v2
2.1
CVSS v3
5.5
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-120237

A flaw in ag-ui-protocol ag-ui up to 0.0.58 allows manipulation of the isInterruptExpired function, leading to excessive resource consumption. The vulnerability can be exploited remotely and an exploit is publicly available. Patching to a fixed version is required to mitigate the risk.

View analysis

medium

CVE-2026-120334

A path‑traversal flaw exists in deepset‑ai farm 0.8.0 and earlier, allowing remote attackers to read arbitrary files via the vocab_filename argument in EmbeddingTokenizer.from_pretrained. The vulnerability is publicly known and can be exploited without authentication. It affects any deployments of the unsupported farm library.

View analysis

medium

CVE-2026-120343

A cross-site scripting (XSS) vulnerability exists in the manageassessment2.php file of the CloudClassroom-PHP-Project. This flaw allows remote attackers to inject malicious scripts via the ExamName and question parameters. The issue is significant because the vendor is unresponsive, leaving users without an official patch.

View analysis

medium

CVE-2026-55264

The CVE-2026-55264 flaw in Android's DownloadProvider allows local information disclosure without user interaction. It stems from a confused deputy bug in checkWhetherCallingAppHasAccess. The vulnerability can expose sensitive data to any app on the device.

View analysis