CVE-2026-3415
XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
CVSS score
8.7
EPSS probability
%0.5
Risk score
0.0
Published
2 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Dhananjayasj/CVE-2026-34156-NocoBase-Sandbox-Escape-via-Workflow-Execution-Vulnerability-
Makefile Go / Python
Critical buffer validation bypass in deserialize_tensor() (llama.cpp < b8492). Null tensor buffer skips bounds check, enabling unauthenticated arbitrary R/W via GRAPH_COMPUTE. ASLR bypass + RCE over TCP 50052.
Makefile Go / Python
GitHub
0 Click RCE exploit for CVE-2026-34159 Lama.cpp RPC server
Makefile Go / Python
Similar Vulnerabilities
10.0
CVE-2026-5430 Actively exploited
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
W
WorkaroundEPSS %1
9.1
CVE-2026-3418
Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
W
Patch status unknownEPSS %1
9.1
CVE-2025-13590
Authenticated arbitrary file upload via a System REST API requiring administrator permission.
W
Patch verifiedEPSS %1
9.4
CVE-2025-15039
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
W
Patch status unknownEPSS %1
8.6
CVE-2026-4249
Vulnerability in Wso2 API Control Plane
W
Patch status unknownEPSS %1
9.8
CVE-2026-1728
Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
W
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-3415"