CVE-2026-120320

MediumCVSS 4.7/10Last modified Nov 6, 2026

Description

A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.3 is able to resolve this issue. This patch is called 6034dcc880c13079aeb398dbe32c346ebcd3a6d2. It is recommended to upgrade the affected component.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-20CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Nov 2, 2026
Last modified
Nov 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1203229.9A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manCVE-2026-1203234.3A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthrouCVE-2026-1203248.3A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file CVE-2026-1203256.3A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packagCVE-2026-1203264.8DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. WhenCVE-2026-1203275.3The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect useCVE-2026-1203286.9The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers canCVE-2026-1203295.3Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuraCVE-2026-120335.3Out of bounds read in VideoCapture in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the GPU process toCVE-2026-1203307.1Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recCVE-2026-1203315.3Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend usCVE-2026-1203325.1The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can in
CVE-2026-120320: Medium severity, CVSS 4.7 | Vulnix