CVE-2026-122014Medium· 6.3▾ SunlitA vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
npcpy 2.1.0npcpy 2.1.1npcpy 2.1.2npcpy 2.1.3npcpy 2.1.4npcpy 2.1.5npcpy 2.1.6npcpy 2.1.7npcpy 2.1.8npcpy 2.1.9npcpy 2.1.10npcpy 2.1.11npcpy 2.1.12npcpy 2.1.13npcpy 2.1.14npcpy 2.1.15npcpy 2.1.16npcpy 2.1.17npcpy 2.1.18npcpy 2.1.19npcpy 2.1.20npcpy 2.1.21npcpy 2.1.22npcpy 2.1.23npcpy 2.1.24npcpy 2.1.25npcpy 2.1.26npcpy 2.1.27Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-122015Medium· 6.3NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation
CVE-2025-10097Medium· 6.3A vulnerability was identified in SimStudioAI sim up to 1.0.0
CVE-2023-6004Medium· 4.8Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname
CVE-2024-10914High· 8.1D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
CVE-2023-29007High· 7.0Arbitrary configuration injection via `git submodule deinit`
CVE-2021-21353Medium· 6.8Remote code execution in pug