Lucene search
+L

121842 matches found

RedhatCVE
RedhatCVE
added yesterday5 views

CVE-2026-12484

A flaw was found in Keras, specifically within the keras.layers.TorchModuleWrapper.fromconfig method. This vulnerability allows an attacker to perform unsafe deserialization of PyTorch pickle data. By processing untrusted Keras layer configurations, a local attacker could exploit this flaw, leadi...

7.8CVSS7.8AI score0.00204EPSS
Exploits0References4
Ubuntu
Ubuntu
added yesterday3 views

USN-8561-1: FreeRDP vulnerabilities

It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code...

9.8CVSS6.2AI score0.03453EPSS
Exploits20
RedhatCVE
RedhatCVE
added yesterday8 views

CVE-2026-41855

A flaw was found in Spring Framework. In an untrusted Java Message Service JMS environment, the MappingJackson2MessageConverter and JacksonJsonMessageConverter components allow for arbitrary class instantiation. This vulnerability can be exploited by a remote attacker through gadget class...

9.8CVSS5.4AI score0.00268EPSS
Exploits0References4
Nuclei
Nuclei
added yesterday92 views

SPIP Porte Plume Plugin - Remote Code Execution

The porteplume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request. id: CVE-2024-7954 info: name: SPIP Porte Plume...

9.8CVSS9.4AI score0.89947EPSS
Exploits10References5
Nuclei
Nuclei
added yesterday121 views

XWiki < 4.10.20 - Remote code execution

XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user...

10CVSS9.7AI score0.9348EPSS
Exploits1References2
BDU FSTEC
BDU FSTEC
added yesterday4 views

The vulnerability of the linker.exe executable of Rockwell Automation Arena’s discrete event simulation and automation software allows a attacker to execute arbitrary code.

The vulnerability of the linker.exe executable of Rockwell Automation Arena’s event simulation and automation software is related to the execution of operations beyond the buffer boundaries in memory, resulting from incorrect validation of input data. Exploiting this vulnerability allows an...

7.8CVSS6.5AI score0.0018EPSS
Exploits0References2Affected Software1
BDU FSTEC
BDU FSTEC
added yesterday3 views

The vulnerability of the siman.exe executable file of Rockwell Automation Arena’s discrete event simulation and automation software allows a hacker to execute arbitrary code.

The vulnerability of the siman.exe executable file of Rockwell Automation Arena’s discrete event simulation and automation software is related to the execution of operations beyond the buffer in memory due to incorrect validation of input data. Exploiting this vulnerability can allow an attacker ...

7.8CVSS6.5AI score0.0018EPSS
Exploits0References2Affected Software1
BDU FSTEC
BDU FSTEC
added yesterday4 views

The vulnerability of the TorchModuleWrapper.from_config() function in the Keras library allows a hacker to execute arbitrary code.

The vulnerability of the TorchModuleWrapper.fromconfig function in the Keras library is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

7.8CVSS7.9AI score0.00204EPSS
Exploits0References2Affected Software1
Cvelist
Cvelist
added yesterday21 views

CVE-2026-52656

An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a crafted FEX file...

Exploits0References2
BDU FSTEC
BDU FSTEC
added yesterday5 views

The vulnerability of the camel-pqc component in the Apache Camel Java framework allows a attacker to execute arbitrary code.

The vulnerability of the camel-pqc component in the Apache Camel Java framework is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

9CVSS6AI score0.00485EPSS
Exploits1References4Affected Software1
NVD
NVD
added 2 days ago7 views

CVE-2026-12484

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...

7.8CVSS0.00204EPSS
Exploits0References1
ATTACKERKB
ATTACKERKB
added 2 days ago6 views

CVE-2026-12484

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...

7.8CVSS8.2AI score0.00204EPSS
Exploits0References2
NVD
NVD
added 3 days ago10 views

CVE-2026-12228

A stored cross-site scripting XSS vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms latest version. The endpoint stores attacker-controlled promptcontent into DBDirectMessage.content without server-side sanitization. When a victim opens the direct message DM thread,...

8.7CVSS0.00261EPSS
Exploits0References1
Nuclei
Nuclei
added 3 days ago86 views

Atlassian Bitbucket - Remote Command Injection

Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...

8.8CVSS8.9AI score0.99077EPSS
Exploits24References5
CVE
CVE
added 4 days ago62 views

CVE-2026-48062

Summary: CodeIgniter versions before 4.7.3 are affected by a validation bypass in the ext_in upload rule. The rule checks the MIME-derived guessed extension instead of the client-provided filename extension, allowing a file like shell.php (with GIF-like content) to pass validation when the upload...

9.8CVSS6AI score0.00444EPSS
Exploits0References3
Cvelist
Cvelist
added 4 days ago30 views

CVE-2026-48062 CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...

9.8CVSS0.00444EPSS
Exploits0References3
OSV
OSV
added 4 days ago4 views

CVE-2026-48062 CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...

9.8CVSS6AI score0.00444EPSS
Exploits0References5
NVD
NVD
added 4 days ago6 views

CVE-2026-48373

Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

7.8CVSS0.00186EPSS
Exploits0References1
NVD
NVD
added 4 days ago7 views

CVE-2026-14501

IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions...

4.3CVSS0.00332EPSS
Exploits0References1
EUVD
EUVD
added 4 days ago10 views

EUVD-2026-45305

IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions...

4.3CVSS5.9AI score0.00332EPSS
Exploits0References1
Rows per page
Query Builder