235398 matches found
CVE-2026-51974
An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...
CVE-2026-19593
OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause G...
CVE-2026-19592
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets...
CVE-2026-19593
The OpenAI Codex Desktop application for Windows and macOS is vulnerable to remote code execution due to a lack of proper sanitization of configuration settings. When a user opens a workspace containing a repository with a malicious .git/config file, the attr.tree setting and configured clean or ...
Deserialization of Untrusted Data
Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the loadmodel and loadpyfunc...
CVE-2021-2378
creationtimestamp| type| source ---|---|--- 2026-09-01 17:00:45+00:00| seen| https://t.me/cissp/3872 2026-09-02 01:04:32+00:00| seen| https://t.me/cissp/3872 2026-09-11 00:00:07+00:00| seen| https://t.me/cissp/3872...
CVE-2026-84202
A flaw was found in ModelScope. This vulnerability arises from the use of PyYAML's unsafe yaml.Loader when parsing model configuration files. A remote attacker can exploit this by crafting malicious model repositories containing poisoned configuration files. When these files are loaded by a user,...
CVE-2026-84202
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...
CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...
Arbitrary Code Injection
Overview modelscope is a ModelScope: bring the notion of Model-as-a-Service to life. Affected versions of this package are vulnerable to Arbitrary Code Injection due to unsafe YAML deserialization in the model configuration loading paths in modelscope/models/audio/tts/voice.py and...
CVE-2026-12663
A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice ...
CVE-2026-12663 ControlFLASH ® – Improper Access Control
A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice ...
Vulnerabilities in WatchGuard Fireware OS
WatchGuard has identified vulnerabilities in the WatchGuard Fireware OS, specifically in the iked process and the epm-service of the Mobile Security component. These vulnerabilities reside in the iked process and the epm-service of WatchGuard Fireware OS. The iked process contains a stack-based...
CVE-2026-58572
Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges...
CVE-2026-82392
A flaw was found in pnpm, a package manager. An attacker can craft a malicious pnpm-lock.yaml file that, when processed by a user running pnpm install, allows package contents to be written outside the intended nodemodules directory. If the system is configured to allow lifecycle scripts, this pa...
kernel: ipv6: fix possible UAF in icmpv6_rcv()
A flaw was found in the Linux kernel's IPv6 Internet Protocol version 6 implementation. This vulnerability, a Use-After-Free UAF error, occurs due to incorrect caching of network packet addresses before a memory operation. An attacker could potentially exploit this flaw to cause memory corruption...
Important: Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syst...
kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation
A flaw was found in the Linux kernel's userfaultfd mechanism. A local attacker with userfaultfd access could register on shadow stack Virtual Memory Areas VMAs. By discarding a page and injecting a page with chosen return addresses, an attacker could achieve arbitrary code execution. This...
CVE-2026-42007
A flaw was found in Dovecot. An authenticated attacker can use a Sieve script with the editheader extension to trigger a use-after-free vulnerability in the mail editing code. This can lead to memory corruption, potentially crashing the mail delivery process and allowing for arbitrary code...
