CVE-2026-122015

6.3 MEDIUMpublic exploit available

Published 2026-11-04 · Updated 2026-11-04

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely. The exploit has been made public and could be used.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weaknesses

CWE-20

Public exploit & PoC references

https://github.com/NPC-Worldwide/npcpy/
https://github.com/NPC-Worldwide/npcpy/issues/309
https://github.com/user-attachments/files/33302583/poc.zip

All references

https://github.com/NPC-Worldwide/npcpy/
https://github.com/NPC-Worldwide/npcpy/issues/309
https://github.com/user-attachments/files/33302583/poc.zip
https://vuldb.com/cve/CVE-2026-122015
https://vuldb.com/submit/1024531
https://vuldb.com/vuln/431083
https://vuldb.com/vuln/431083/cti

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

LOWCVE-2020-37289PoC
UNSCOREDCVE-2023-5649
MEDIUMCVE-2024-6423
MEDIUMCVE-2025-31980
MEDIUMCVE-2025-32000
CRITICALCVE-2025-71383
HIGHCVE-2026-100113
HIGHCVE-2026-100117

Related by shared AI tags and CWE weakness class. Browse the full archive.