Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite

A vulnerability in the backuprun function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the runhash and repo.path parameters, which can be manipulated to create an...

umbra

Umbra An external overlay for THE FINALS on Linux. It reads the game's memory from a separate process, draws a transparent click-through window on top of it, and provides an aim assist and a triggerbot. Nothing is injected into the game and nothing is ever written back; the tool reads memory and...

CVE-2026-85663

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

CVE-2026-85663

Aim 3.29.1 remote tracking server contains an unauthenticated method dispatch vulnerability: incoming requests are not authenticated, and methods are resolved via getattr without an allowlist check. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary m...

EUVD-2026-71119

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

CVE-2026-85663 Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

CVE-2026-85663 Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

CVE-2026-85663 Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

CVE-2026-85663: Missing Authentication for Critical Function

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

PT-2026-85556

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

Aim Panel - Detect

Aim, an open-source, self-hosted AI/ML experiment tracking tool used to log, query, and visualize machine learning training runs, was detected by matching its distinctive web UI page title and meta description, thereby minimizing false positives associated with the generic term "Aim". !/usr/bin/e...

adpred (>=1.1.2, <=1.2.7), aeronet (>=0.0.8, <=0.0.18) +57 more potentially affected by CVE-2026-12484 via keras (2.2.4)

keras PYPI version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - adpred =1.1.2, =0.0.8, =0.2.7, =0.0.1, =0.2.0rc0, =0.0.1, =0.1.3, =0.2.3, =1.1.0, =0.1.0, =0.0.4, =0.65.0, =0.66.0 and more Source cves: CVE-2026-1248...

adhesive (>=0.5.0, <=0.12.0), aiida-core (1.0.0) +40 more potentially affected by CVE-2026-44405 via paramiko (2.6.0)

paramiko PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - adhesive =0.5.0, =0.2.2, =0.0.2, =0.2.0, =0.2.0, =1.0.4, =4.0.2, =2.0.4, =2.0.0, =4.0.0, =3.0.2, =3.1.0 and more Source cves: CVE-2026-44405...

adpred (>=1.1.2, <=1.2.7), aeronet (>=0.0.8, <=0.0.18) +57 more potentially affected by CVE-2025-12060 via keras (2.2.4)

keras PYPI version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - adpred =1.1.2, =0.0.8, =0.2.7, =0.0.1, =0.2.0rc0, =0.0.1, =0.1.3, =0.2.3, =1.1.0, =0.1.0, =0.0.4, =0.65.0, =0.66.0 and more Source cves: CVE-2025-1206...

PYSEC-2026-1087 Aim vulnerable to Cross-site Scripting

Cross-site Scripting XSS in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox...

Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution

A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component runview Object Handler. The manipulation of the argument Query leads to sandbox issue. The attack can be...

PYSEC-2026-1088 Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution

A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component runview Object Handler. The manipulation of the argument Query leads to sandbox issue. The attack can be...

PYSEC-2026-1085 Aim Excessive Data Query Operations in a Large Data Table vulnerability

In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of Text objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these...

Aim Excessive Data Query Operations in a Large Data Table vulnerability

In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of Text objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these...

PYSEC-2026-1089 Aim Uncontrolled Resource Consumption vulnerability

In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large...