CVE-2026-14687
A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function _deduplicate_results of the file InsightEngine/agent.py of the component InsightEngine search-result Deduplication. Executing a manipulation can lead to partial string comparison. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.53%
- CWE
- CWE-187, CWE-697
- Published
- 2026-07-05
- Last modified
- 2026-07-06
Affected products
- 666ghj BettaFish
- 666ghj BettaFish
Weakness type
Related vulnerabilities
- CVE-2026-87853 — Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
- CVE-2026-84376 — Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
- CVE-2026-62750 — Windows HTTP Protocol Stack Tampering Vulnerability
- CVE-2026-45692 — Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
- CVE-2026-55602 — http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
- CVE-2026-44837 — view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
- CVE-2026-35031 — Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
- CVE-2026-34785 — Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching