CVE-2026-18948 Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server

A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...

EUVD-2026-55818

A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...

CVE-2026-18948

A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...

EUVD-2026-55815

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...

CVE-2026-18941

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...

CVE-2026-18941

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...

CVE-2026-21075

Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...

CVE-2026-21076

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21084

CVE-2026-21084 affects Samsung SmartThings prior to version 1.8.47.24, with improper access control that allows local attackers to access sensitive information. The description and connected records confirm a local attack vector with low privileges required and no user interaction, resulting in c...

CVE-2026-21083

Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...

CVE-2026-21081

Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability...

CVE-2026-21077

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21076

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21075

Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...

EUVD-2026-55100

Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...

CVE-2026-21060

Samsung Contacts shows an improper input validation vulnerability in the app prior to SMR Aug-2026 Release 1, enabling a physical attacker to access data across multiple user profiles. The issue affects Samsung Contacts on affected devices and has a CVSS 4.0 vector with a base score of 6.7 (Mediu...

CVE-2026-14211

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...

CVE-2026-15238

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account Subscriber and above to modify or overwrite the personal data of any customer by supplying an arbitrary...

Vulnerability of the DOM component: Security features in Firefox web browser and Thunderbird email client, which allow attackers to access confidential data and compromise its integrity

Vulnerability of the DOM component: The security of Firefox web browser and Thunderbird email client is related to the lack of data security mechanisms. Exploiting this vulnerability allows a malicious actor to access confidential data and compromise its integrity...

The vulnerability of the Protection component in the Firefox web browser and the Thunderbird email client allows attackers to access confidential data.

The vulnerability of the Protection component in the Firefox web browser and the Thunderbird email client relates to the disclosure of information. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data...