CVE-2026-5003

A vulnerability was found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. This affects the function handle_index of the file rag_system/api_server.py of the component Web Interface. Performing a manipulation results in information disclosure. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-200
• CWE-284

• https://github.com/August829/CVEP/issues/10
• https://vuldb.com/submit/779148
• https://vuldb.com/vuln/353890
• https://vuldb.com/vuln/353890/cti

Published

Mar 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50019yt-dlp is a command-line audio/video downloader. From 2023.0…7.4
• CVE-2026-5002A vulnerability has been found in PromtEngineer localGPT up …7.3
• CVE-2026-50020Netty is a network application framework for development of …5.3
• CVE-2026-50021pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm…8.1
• CVE-2026-50023yt-dlp is a command-line audio/video downloader. Prior to 20…9.6
• CVE-2026-50026Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-50030DataEase is an open source data visualization and analysis t…7.1
• CVE-2026-50031ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer ov…7.5
• CVE-2026-50032A NULL pointer dereference in the MMS Write Named Variable L…8.7
• CVE-2026-50033Local privilege escalation due to DLL hijacking vulnerabilit…7.3
• CVE-2026-50034An attacker within BLE communication range can passively int…7.1
• CVE-2026-50039The affected product is vulnerable to a stack-based buffer o…8.7