CVE-2026-95649Medium· 6.1▾ SunlitIRISPowerscan insufficiently restrict the use of untrusted scripts. An authenticated user with access to script functionality can import or modify scripts that are executed by the application, potentially resulting in arbitrary code exec…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
IRISPowerscan insufficiently restrict the use of untrusted scripts. An authenticated user with access to script functionality can import or modify scripts that are executed by the application, potentially resulting in arbitrary code execution in the security context of the Windows user running IRISPowerscan.
IRISPowerscan <= 12.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94459High· 7.2IRISPowerscan Default accounts with predictable credentials
CVE-2026-94460High· 7.2IRISPowerscan Insecure default privilege assignment for installation account
CVE-2026-83493NoneDistributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master
CVE-2026-123019High· 7.3eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere
CVE-2026-110802Medium· 6.1Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
CVE-2026-122160Medium· 6.3myshell-ai AIlice HuggingFace Model Wrapper AModelCausalLM.py LoadModel_PEFT inclusion of functionality from untrusted control sphere