CVE-2026-6991

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability was determined in colinhacks Zod up to 4.3.6. The impacted element is an unknown function of the file packages/zod/src/v4/core/regexes.ts of the component CUID Data Type Handler. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Apr 25, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-699109.8Stack-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code over a network.CVE-2026-699117.0Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-699138.1Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.CVE-2026-699145.5Out-of-bounds read in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.CVE-2026-699157.0Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-699167.8Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-699187.8Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.CVE-2026-699195.5Out-of-bounds read in Windows Cryptographic Services allows an authorized attacker to disclose information locally.CVE-2026-69927.2A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the function BTRequestGetSmartConnectStatus of the file /etc/iniCVE-2026-699217.8Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-699226.5Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-699237.8Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.
CVE-2026-6991: Medium severity, CVSS 6.3 | Vulnix