CVE-2026-7058

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A vulnerability has been found in 666ghj MiroFish up to 0.1.2. The impacted element is the function SimulationIPCClient.send_command of the file backend/app/services/simulation_ipc.py of the component Inter-Process Communication. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Apr 26, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-705808.8Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally.CVE-2026-705817.8Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-705826.4Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an CVE-2026-705837.8Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.CVE-2026-705847.8Access of resource using incompatible type ('type confusion') in Windows Core Messaging allows an authorized attacker to elevate privileges CVE-2026-705857.0Use after free in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to execute code locally.CVE-2026-705868.8Heap-based buffer overflow in Windows Paint allows an unauthorized attacker to execute code over a network.CVE-2026-705877.5Improper null termination in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.CVE-2026-705885.0Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanit CVE-2026-705894.8Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offe CVE-2026-70595.3A vulnerability was found in 666ghj MiroFish up to 0.1.2. This affects the function get_simulation_posts of the file backend/app/api/simulat CVE-2026-705904.8Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff use