Dashboard / CVE-2026-118275

CVE-2026-118275

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 74/100
Published: 2026-10-28 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
AT: None
VC: None
VI: None
VA: Low

Description

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as c76e17272e52c12c6dcf68905b1df978c39e9aa5. It is advisable to implement a patch to correct this issue.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
a2ui-project a2ui 0.10.0

References & Advisories (8)

Bug Bounty Relevance

74 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.9 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

EPSS — Exploitation Probability

0.43%
Raw Score 0.004280
Percentile 37.0%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00428
2026-10-28
0.00428

Intelligence Sources

mitre ref →
nvd ref →

External Links