Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite

A vulnerability in the backuprun function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the runhash and repo.path parameters, which can be manipulated to create an...

umbra

Umbra An external overlay for THE FINALS on Linux. It reads the game's memory from a separate process, draws a transparent click-through window on top of it, and provides an aim assist and a triggerbot. Nothing is injected into the game and nothing is ever written back; the tool reads memory and...

Missing Authentication for Critical Function

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the lack of authentication in the getattr process. An attacker can execute arbitrary methods, register unauthorize...

CVE-2026-85663

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

CVE-2026-85663 Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

EUVD-2026-71119

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

CVE-2026-85663

Aim 3.29.1 remote tracking server contains an unauthenticated method dispatch vulnerability: incoming requests are not authenticated, and methods are resolved via getattr without an allowlist check. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary m...

CVE-2026-85663 Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

CVE-2026-85663 Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

CVE-2026-85663

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

CVE-2026-85663: Missing Authentication for Critical Function

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

PT-2026-85556

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

Malicious code in @zalastax/nolb-aim (npm)

The package @zalastax/nolb-aim was found to contain malicious code. --- Credit: OpenSSF source...

Aim Panel - Detect

Aim, an open-source, self-hosted AI/ML experiment tracking tool used to log, query, and visualize machine learning training runs, was detected by matching its distinctive web UI page title and meta description, thereby minimizing false positives associated with the generic term "Aim". !/usr/bin/e...

PYSEC-2026-1087 Aim vulnerable to Cross-site Scripting

Cross-site Scripting XSS in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox...

deepfake-gitract (>=0.0.1, <=1.0.2), deepfakebody (>=0.0.3, <=1.0.0) +11 more potentially affected by CVE-2025-51464 via aim (>=3.17.4, <=3.29.1)

aim PYPI version =3.17.4, =0.0.1, =0.0.3, =0.0.1, =1.1.5, =0.1.1, =0.0.1, =0.0.1, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2025-51464 Source advisory: OSV:PYSEC-2026-1087...

PYSEC-2026-1088 Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution

A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component runview Object Handler. The manipulation of the argument Query leads to sandbox issue. The attack can be...

deepfake-gitract (>=0.0.1, <=1.0.2), deepfakebody (>=0.0.3, <=1.0.0) +11 more potentially affected by CVE-2025-5321 via aim (>=3.17.4, <=3.29.1)

aim PYPI version =3.17.4, =0.0.1, =0.0.3, =0.0.1, =1.1.5, =0.1.1, =0.0.1, =0.0.1, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2025-5321 Source advisory: OSV:PYSEC-2026-1088...

Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution

A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component runview Object Handler. The manipulation of the argument Query leads to sandbox issue. The attack can be...

dsipts (>=1.1.5, <=1.1.19), llm-toys (0.1.1) +2 more potentially affected by CVE-2025-0189 via aim (>=3.17.4, <=3.20.1)

aim PYPI version =3.17.4, =1.1.5, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2025-0189 Source advisory: OSV:PYSEC-2026-1089...