CVE-2026-7712

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in MindsDB up to 26.01. Affected is the function pickle.loads of the component Pickle Handler. The manipulation leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-20 CWE-502

Affected software

No affected versions have been published.

Timeline

Published: May 4, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-771208.7CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause pri CVE-2026-771216.5A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata fie CVE-2026-771224.3An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Rep CVE-2026-771236.5Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabi CVE-2026-771247.2In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether s CVE-2026-771257.1A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly e CVE-2026-771276.0The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authen CVE-2026-771286.3The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-o CVE-2026-771297.7The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user w CVE-2026-77136.3A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generate_au CVE-2026-771305.3The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key t CVE-2026-771315.3When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitat