CVE-2026-2008

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in abhiphile fermat-mcp up to 47f11def1cd37e45dd060f30cdce346cbdbd6f0a. This vulnerability affects the function eqn_chart of the file fmcp/mpl_mcp/core/eqn_chart.py. Performing a manipulation of the argument equations results in code injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
abhiphilefermat-mcp47f11def1cd37e45dd060f30cdce346cbdbd6f0a

References

Timeline

Published
Feb 6, 2026
Last modified
Jun 17, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-200805.3A vulnerability in the SSH service of Cisco IEC6400 Wireless Backhaul Edge Compute Software could allow an unauthenticated, remote attacker CVE-2026-200816.5Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an afCVE-2026-200828.6A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software couldCVE-2026-200836.5A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated, local attacker with CVE-2026-200848.6A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packetsCVE-2026-200856.1A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSCVE-2026-200868.6A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless ControllerCVE-2026-200874.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileCVE-2026-200884.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileCVE-2026-200894.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileCVE-2026-20096.5A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/phCVE-2026-200904.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privile
CVE-2026-2008: High severity, CVSS 8.8 | Vulnix