138 matches found
EUVD-2026-32609
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs.name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentom...
PT-2026-45980
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs.name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentom...
CVE-2026-40610 BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.38 and prior, the build packaging workflow follows attacker-controlled symlinks inside the build context and copies the referenced file contents into the generated Bento...
BentoML åē½®é¾ę„ę¼ę“
BentoML is an open-source model service library developed by BentoML. It is used to build high-performance and scalable artificial intelligence applications using Python. Versions of BentoML prior to 1.4.38 contained a post-link vulnerability. This vulnerability stemmed from the fact that the bui...
CVE-2026-33813 vulnerabilities
Vulnerabilities for packages: seaweedfs-operator, seaweedfs-rocksdb-fips, bento, seaweedfs, mattermost, mattermost-fips, seaweedfs-operator-fips, gitea-fips, rclone, seaweedfs-fips, kubescape, kubescape-server-fips, bento-fips, ollama-fips, pdfcpu, kubescape-server, gitea, ollama, rclone-fips,...
PT-2026-39663
Name of the Vulnerable Software and Affected Versions BentoML versions prior to 1.4.39 Description BentoML is a Python library used for building online serving systems optimized for AI applications and model inference. The issue occurs because the template src/bentoml/...
CVE-2026-41602 vulnerabilities
Vulnerabilities for packages: nri-cassandra-fips, apm-server-fips, aws-otel-collector-fips, nri-jmx-fips, opentelemetry-collector, seaweedfs-rocksdb-fips, aws-otel-collector, loki, grafana-alloy, bento, peerdb-flow, vault, seaweedfs, elastic-agent, cadence, seaweedfs-rocksdb,...
GHSA-WF45-Q9CH-Q8GH vulnerabilities
Vulnerabilities for packages: nri-cassandra-fips, apm-server-fips, aws-otel-collector-fips, nri-jmx-fips, opentelemetry-collector, seaweedfs-rocksdb-fips, aws-otel-collector, loki, grafana-alloy, bento, peerdb-flow, vault, seaweedfs, elastic-agent, cadence, seaweedfs-rocksdb,...
CVE-2026-41653 BentoPDF: Stored XSS via Markdown Editor Leading to Persistent File Exfiltration
BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site scripting vulnerability was identified in BentoPD. An attacker may be able to execute arbitrary JavaScript in certain circumstances in Markdown to PDF Tool. This issue has been patched in version 2.8...
GHSA-MCFX-4VC6-QGXV BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context
Summary BentoML's bentoml build packaging workflow follows attacker-controlled symlinks inside the build context and copies the referenced file contents into the generated Bento artifact. If a victim builds an untrusted repository or other attacker-supplied build context, the attacker can place a...
CVE-2026-41602 vulnerabilities
Vulnerabilities for packages: grafana, telegraf, nri-cassandra, tempo, jaeger, minio, temporal, datadog-agent, bento, seaweedfs, nri-jmx, loki, jitsucom-bulker, opentelemetry-collector, opentelemetry-collector-contrib, splunk-otel-collector, grafana-alloy, nri-kafka, falcosidekick,...
GHSA-WF45-Q9CH-Q8GH vulnerabilities
Vulnerabilities for packages: grafana, telegraf, nri-cassandra, tempo, jaeger, minio, temporal, datadog-agent, bento, seaweedfs, nri-jmx, loki, jitsucom-bulker, opentelemetry-collector, opentelemetry-collector-contrib, splunk-otel-collector, grafana-alloy, nri-kafka, falcosidekick,...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: smokescreen, nfpm, swagger, smarter-device-manager, terraform, rancher-telemetry, kube-state-metrics, sftpgo-plugin-geoipfilter, maru, rqlite, influx, go-licenses, secrets-store-csi-driver-provider-aws, rabbitmq-messaging-topology-operator, policy-controller, gostats...
GHSA-7MR4-XJXG-34G6 vulnerabilities
Vulnerabilities for packages: redka, swagger, kyverno-notation-aws, smarter-device-manager, terraform, prometheus-adapter, polaris, cert-manager-csi-driver, terraform-provider-sendgrid, kube-state-metrics, sriov-network-device-plugin, gitness, sftpgo-plugin-geoipfilter, vault-env, authservice,...
GHSA-HFVC-G4FC-PQHX vulnerabilities
Vulnerabilities for packages: harbor-registry, k8sgpt, terraform-provider-grafana, kyverno-notation-aws, prometheus-alertmanager, tempo, prometheus-adapter, k9s, docker-compose, jaeger, kube-state-metrics, trufflehog, gitness, vault-env, cloud-provider-azure, kuma, minio, dive,...
GHSA-FGV4-6JR3-JGFW BentoML: Command Injection in cloud deployment setup script
Commit ce53491 March 24 fixed command injection via systempackages in Dockerfile templates and images.py by adding shlex.quote. However, the cloud deployment path in src/bentoml/internal/cloud/deployment.py was not included in the fix. Line 1648 interpolates systempackages directly into a shell...
CVE-2026-5236
A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument npresentations leads to heap-based buffer overflow. The attack needs to be performed...
CVE-2026-5236 Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based overflow
A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument npresentations leads to heap-based buffer overflow. The attack needs to be performed...
CVE-2026-5235 Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-based overflow
A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641. This impacts the function AP4BitReader::ReadCache of the file Ap4Dac4Atom.cpp of the component MP4 File Parser. This manipulation causes heap-based buffer overflow. The attack needs to be launched locally. The exploit has been...