37226 matches found
CVE-2026-61756
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...
CVE-2026-61756
NVIDIA Megatron Bridge (versions 0.0 to 0.5.0) is affected by a deserialization of untrusted data vulnerability (CWE-502). A local attacker with low privileges and no user interaction can exploit this to achieve code execution, data tampering, and information disclosure . The CVSS 3.1 score is 7....
EUVD-2026-69305
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...
CVE-2026-61756
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...
CVE-2026-61757
NVIDIA Megatron Bridge versions 0.0 through 0.5.0 contain a deserialization of untrusted data vulnerability (CWE-502) rated HIGH (CVSS 7.8) . A local attacker with low privileges and no user interaction could exploit this to achieve code execution, data tampering, and information disclosure . The...
CVE-2026-61757
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...
CVE-2026-61757
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...
CVE-2026-61757
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...
EUVD-2026-69304
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...
Arbitrary Code Injection
Overview modelscope is a ModelScope: bring the notion of Model-as-a-Service to life. Affected versions of this package are vulnerable to Arbitrary Code Injection due to unsafe YAML deserialization in the model configuration loading paths in modelscope/models/audio/tts/voice.py and...
CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...
CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...
CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...
CVE-2026-84202
ModelScope (through v1.40.0 ) uses PyYAML's unsafe yaml.Loader to parse model configuration files, enabling arbitrary code execution via Python object construction tags. An attacker can craft a malicious model repository with a poisoned configuration file that executes code when a user loads the ...
EUVD-2026-69289
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...
CVE-2026-83557
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
DEBIAN-CVE-2026-83557
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
CVE-2026-83557
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
CVE-2026-83557
jackson-databind ships a default PolymorphicTypeValidator (DefaultBaseTypeLimitingValidator) used automatically when @JsonTypeInfo is present without a custom validator. The flaw: java.lang.Comparable was omitted from its "unsafe base types" deny-list, so isSafeSubType returned true unconditional...
CVE-2026-83557 jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...