CVE-2026-40573High· 8.6▾ MidnightPoC availableNovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the `Nova` interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious `.nv` script through the shell p…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.3 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the Nova interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious .nv script through the shell permits a local user to execute code with kernel privileges without security checks. The advisory identifies VM initialization in zig/nova/vm.zig as the affected component; script execution is not isolated in a restricted Ring 3 privilege domain. This issue is fixed in version 0.25-beta.1.
NovumOS < 0.25-beta.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108820Medium· 6.3A weakness has been identified in agno-agi agno up to 3.0.6/3.1.1
CVE-2026-9209Critical· 9.8mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against t…
CVE-2026-106378High· 8.3Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page
CVE-2026-102247Medium· 6.8A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602
CVE-2026-77521Critical· 10.0MaxKB is an open-source AI assistant for enterprise
CVE-2025-54991Medium· 5.5JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS)