CVE-2026-6878

MediumCVSS 5.6/10Last modified Jun 17, 2026

Description

A vulnerability was identified in ByteDance verl up to 0.7.0. Affected is the function math_equal of the file prime_math/grader.py. The manipulation leads to sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-264 CWE-265

Affected software

No affected versions have been published.

Timeline

Published: Apr 23, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-687806.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-687816.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-687829.9Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to CVE-2026-687846.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-687854.9Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-687868.8Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-687877.8Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.CVE-2026-687899.9Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to CVE-2026-68792.0`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, CVE-2026-687917.5Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.CVE-2026-687927.8Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to ele CVE-2026-687937.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.