CVE-2026-73226High· 8.8▾ Twilightelecterm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.8%
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-68613Critical· 9.9n8n is an open source workflow automation platform
CVE-2026-116612High· 7.8A flaw was found in GStreamer Editing Services (gst-editing-services)
CVE-2026-102734Medium· 5.5asteval is a Python expression evaluator designed for restricted execution
CVE-2026-108948Medium· 5.4A vulnerability has been found in code-projects Online Reviewer System 1.0
CVE-2026-108819High· 7.3A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1
CVE-2026-103663Medium· 6.9Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function