CVE-2026-77926High· 8.8▾ TwilightAix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat inp…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.
Aix-DB >= 1.2.4 <= 1.2.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112780High· 8.8Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@
CVE-2026-66781Medium· 5.4Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication
CVE-2026-54702High· 7.3Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code
CVE-2026-109412Critical· 9.9An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.
CVE-2026-102734Medium· 5.5asteval is a Python expression evaluator designed for restricted execution
CVE-2026-89110Critical· 9.9SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality