CVE-2026-88755

HighCVSS 7.8/10Last modified Oct 16, 2026

Description

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78CWE-200CWE-284CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2026
Last modified
Oct 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-887565.3Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public logiCVE-2026-88767.3Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis aleCVE-2026-887615.3The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portions of which are adverCVE-2026-887635.9A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distCVE-2026-887645.4The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification maCVE-2026-887658.5GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under cerCVE-2026-88776.4The Responsive Video Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rem_video' shortcode in versions upCVE-2026-887706.5A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because thCVE-2026-887719.8Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, beCVE-2026-887728.1Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14CVE-2026-8877310.0Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler CVE-2026-887747.2Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14