CVE-2026-108962

A vulnerability has been found in storyicon comfyuisegmentanything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig.file2dict of the file localgroundingdino/util/slconfig.py of the component GroundingDINO Model Loading. Such manipulation of the...

CVE-2026-108961

A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.init of the file paddlex/inference/models/textdetection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possib...

CVE-2026-108966

The SourceCodester Performance Indicator System 1.0 is vulnerable to an SQL injection flaw within the /opils/staff/product.php file. The vulnerability occurs during the processing of the Category argument, which allows an attacker to initiate a remote attack. While the documents state that an exp...

CVE-2026-108965

The SourceCodester Performance Indicator System 1.0 is vulnerable to SQL injection due to a flaw in the code of the file /opils/staff/edit_quantity.php . An attacker can remotely trigger this vulnerability by manipulating the pqty argument. The exploit has been publicly disclosed and may be utili...

EUVD-2026-98278

A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made publ...

CVE-2026-108962

A code injection vulnerability exists in the storyicon comfyui_segment_anything project, specifically within the GroundingDINO Model Loading component. The issue is located in the SLConfig._file2dict function of the local_groundingdino/util/slconfig.py file, where manipulation of the config argum...

CVE-2026-108958

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

CVE-2026-108957

A security flaw has been discovered in TinyLLaVA TinyLLaVAFactory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function loadtextconfig of the file tinyllava/model/configurationtinyllava.py of the component TinyLlavaConfig. Performing a manipulation of the argument...

CVE-2026-108961 PaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.__init__ code injection

A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.init of the file paddlex/inference/models/textdetection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possib...

CVE-2026-108960 Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds

A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function createstripedmattogpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulation results in out-of-bounds read. The...

CVE-2026-108960

A vulnerability exists in Tiiny-AI PowerInfer (up to commit 8bd56d69906c9d2dba4d3bf6899763401e01a9a4) within the FFN GPU-split Loader component. Specifically, the create_striped_mat_to_gpu function in the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu is susceptible to an out-of-bounds read . ...

CVE-2026-108959 itsourcecode Online Cake Ordering System addtransacdetail.php sql injection

A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /addtransacdetail.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-109786

In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter config/filter.d/sshd.conf accepts an "on " suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as "x VICTIM-SOURCE-IP-ADDRESS on" to make...

CVE-2023-5965

PoC for Espo CRM 7.2.4 CVE-2023-5965 & CVE-2023-5965 CVE-2023-5965 Advisory An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution. To upload the file go to...

CVE-2026-108958

A deserialization vulnerability exists in TensorLayer versions up to 2.2.4 . The flaw is located in the load_hdf5_graph function within the tensorlayer/files/utils.py file of the HDF5 Loading component. By manipulating the model_config argument, an attacker can trigger a deserialization attack. T...

CVE-2026-108958 TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

EUVD-2026-98267

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

CVE-2026-108958 TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

CVE-2026-108947

A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function loadckpt of the file torchdistill/common/mainutil.py. Executing a manipulation of the argument srcckpt can lead to deserialization. The attack needs to be launched locally. The exploit has been...

CVE-2026-108957 TinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_tinyllava.py _load_text_config code injection

A security flaw has been discovered in TinyLLaVA TinyLLaVAFactory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function loadtextconfig of the file tinyllava/model/configurationtinyllava.py of the component TinyLlavaConfig. Performing a manipulation of the argument...