CVE-2026-120202Medium· 6.5▾ TwilightPoC availableHighflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files. Attacke…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files. Attackers can distribute a skill bundle with an unchecked-hash .pyc under scripts/<subdir>/pycache/ that ramparts silently ignores, while CPython executes it when the skill runs.
ramparts >= 0.8.1 <= 0.8.10Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44267Critical· 9.8Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter
CVE-2026-21400Medium· 6.7Protection mechanism failure for some Intel(R) AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escalation of privilege
CVE-2026-115480Medium· 5.3baserCMS: Public Web API mail-form submission bypasses image CAPTCHA
CVE-2026-110689Medium· 5.3A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6
CVE-2026-102539Medium· 5.7Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities
CVE-2026-104774Medium· 5.8OWASP Coraza WAF is a golang modsecurity compatible web application firewall library