CVE-2026-102911

Publié : 30 septembre 2026

Modifié : 30 septembre 2026

Score CVSS

9.9

CRITICAL

Description détaillée

A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 0.11.8 is able to address this issue. This patch is called 360867034e79175b45c8e04a98e4ca712bbaca35. Upgrading the affected component is advised.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Références et Patchs

https://github.com/zosmaai/pi-llm-wiki/https://github.com/zosmaai/pi-llm-wiki/commit/360867034e79175b45c8e04a98e4ca712bbaca35 https://github.com/zosmaai/pi-llm-wiki/issues/185 https://github.com/zosmaai/pi-llm-wiki/pull/186 https://github.com/zosmaai/pi-llm-wiki/releases/tag/v0.11.8 https://vuldb.com/cve/CVE-2026-102911 https://vuldb.com/submit/953898 https://vuldb.com/vuln/411587 https://vuldb.com/vuln/411587/cti

Dernières Vulnérabilités

CVE-2026-103111

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.

VOIR DÉTAILS

CVE-2026-102913

A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_enrollment. The manipulation results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

VOIR DÉTAILS

CVE-2026-86134

A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.

VOIR DÉTAILS