CVE-2026-95182

CriticalCVSS 10.0/10Last modified Oct 16, 2026

Description

An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2026
Last modified
Oct 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-951838.8An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack vCVE-2026-951845.9Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a DenCVE-2026-95194.3A security flaw has been discovered in stonith404 pingvin-share up to 1.13.0. This affects the function getServerSideProps of the file frontCVE-2026-95204.3A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub. This impacts an unknown function of the file packages/generator/tempCVE-2026-952087.5An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 and v5.9.2 allows attackers to cause a Denial of SCVE-2026-952095.9An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).CVE-2026-95217.3A security vulnerability has been detected in fraillt bitsery up to 5.2.4. Affected is the function loadFromSharedState in the library incluCVE-2026-952104.8Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.CVE-2026-95225.4Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user withouCVE-2026-95237.3A vulnerability was detected in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2. Affected by this CVE-2026-95246.3A flaw has been found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is the function execute of the component REST CVE-2026-95257.3A vulnerability has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /admin/edit_judge.php
CVE-2026-95182: Critical severity, CVSS 10.0 | Vulnix