c4v-py (>=0.1.0.dev1, <=0.1.0.dev202107081840), medaka-cpu (1.5.0) +4 more potentially affected by CVE-2022-29194 via tensorflow-cpu (>=2.1.0, <=2.5.3)

tensorflow-cpu PYPI version =2.1.0, =0.1.0.dev1, =0.5.1, =0.102.0.dev0, =1.5.2, =1.7.4 Source cves: CVE-2022-29194 Source advisory: OSV:PYSEC-2026-3336...

c4v-py (>=0.1.0.dev1, <=0.1.0.dev202107081840), medaka-cpu (1.5.0) +4 more potentially affected by CVE-2022-29193 via tensorflow-cpu (>=2.1.0, <=2.5.3)

tensorflow-cpu PYPI version =2.1.0, =0.1.0.dev1, =0.5.1, =0.102.0.dev0, =1.5.2, =1.7.4 Source cves: CVE-2022-29193 Source advisory: OSV:PYSEC-2026-3265...

alwakeupword (1.0.0), armadillin (>=0.0.2, <=0.53.0) +33 more potentially affected by CVE-2022-23577 via tensorflow (>=2.6.0, <=2.6.2)

tensorflow PYPI version =2.6.0, =0.0.2, =1.0.1, =0.0.9, =0.2.0, =4.5.2, =1.1.2, =0.2.0, =0.0.1, =0.1.5, =1.0.3, =1.0.6 and more Source cves: CVE-2022-23577 Source advisory: OSV:PYSEC-2026-3135...

alwakeupword (1.0.0), armadillin (>=0.0.2, <=0.53.0) +33 more potentially affected by CVE-2022-23583 via tensorflow (>=2.6.0, <=2.6.2)

tensorflow PYPI version =2.6.0, =0.0.2, =1.0.1, =0.0.9, =0.2.0, =4.5.2, =1.1.2, =0.2.0, =0.0.1, =0.1.5, =1.0.3, =1.0.6 and more Source cves: CVE-2022-23583 Source advisory: OSV:PYSEC-2026-3191...

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: NOTE: This update was retracted as it contained incorrect provides/obsolets on mozilla-nss-certs. Update to Firefox 140.12.0 ESR MFSA 2026-58, bsc1268071: CVE-2026-12289: Privilege escalation in the Graphics: WebRender component...

External Control of File Name or Path

Overview phantom-audio is an AI audio engineering system -- makes Claude a professional audio engineer Affected versions of this package are vulnerable to External Control of File Name or Path via unconfined tool path handling and lack of input size restrictions. An attacker can write or overwrit...

firefox: thunderbird: Incorrect boundary conditions in the Web Audio component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Web Audio component...

kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB audio subsystem. An inconsistency in how USB audio playback and capture streams are handled can lead to an out-of-bounds write to a memory buffer. This can result in a system crash, causing a denial of service for a...

gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser

A vulnerability was found in the GStreamer RealMedia demuxer gst-plugins-ugly. When processing a RealMedia .rm file, the demuxer parses MDPR media properties chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sampl...

CVE-2026-55646

A flaw was found in vLLM, an inference and serving engine for large language models. A remote attacker, by submitting an oversized audio file to the /v1/audio/transcriptions or /v1/audio/translations routes, can cause the system to allocate excessive memory. This occurs before the configured file...

Important: firefox

Issue Overview: Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. CVE-2026-12289 Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firef...

cosmopower (0.2.0), guardrail-ml (>=0.0.14, <=0.0.15) +7 more potentially affected by CVE-2025-12060 via keras (2.15.0rc1)

keras PYPI version 2.15.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - cosmopower 0.2.0 - guardrail-ml =0.0.14, =0.5.10, =0.1.0, =2.14.0rc0, =2.14.0rc0, =2.14.0rc1 - tensorflow-text 2.13.0rc0 - tf-extensions 0.1.0...

cosmopower (0.2.0), guardrail-ml (>=0.0.14, <=0.0.15) +7 more potentially affected by CVE-2025-12058 via keras (2.15.0rc1)

keras PYPI version 2.15.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - cosmopower 0.2.0 - guardrail-ml =0.0.14, =0.5.10, =0.1.0, =2.14.0rc0, =2.14.0rc0, =2.14.0rc1 - tensorflow-text 2.13.0rc0 - tf-extensions 0.1.0...

PYSEC-2026-1573 LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities

Summary A Server-Side Request Forgery SSRF vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. This can lead to the exposure of sensitive internal services, reconnaissance of the internal network, or...

Rasa Pro Missing Authentication For Voice Connector APIs

VulnerabilityA vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated...

harmonai-tools (>=0.0.6, <=0.0.7), stable-audio-tools (>=0.0.7, <=0.0.10) potentially affected by CVE-2024-8966 via gradio (3.42.0)

gradio PYPI version 3.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - harmonai-tools =0.0.6, =0.0.7, =0.0.10 Source cves: CVE-2024-8966 Source advisory: OSV:PYSEC-2026-1410...

harmonai-tools (>=0.0.6, <=0.0.7), stable-audio-tools (>=0.0.7, <=0.0.10) potentially affected by CVE-2024-8021 via gradio (3.42.0)

gradio PYPI version 3.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - harmonai-tools =0.0.6, =0.0.7, =0.0.10 Source cves: CVE-2024-8021 Source advisory: OSV:PYSEC-2026-1411...

Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...

harmonai-tools (>=0.0.6, <=0.0.7), stable-audio-tools (>=0.0.7, <=0.0.10) potentially affected by CVE-2024-12217 via gradio (3.42.0)

gradio PYPI version 3.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - harmonai-tools =0.0.6, =0.0.7, =0.0.10 Source cves: CVE-2024-12217 Source advisory: OSV:PYSEC-2026-1418...

Gradio Vulnerable to Arbitrary File Deletion

A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset...