1005 matches found
CVE-2026-0762 GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability
GPT Academic streamdaas Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Interaction with a malicious DAAS server is required to exploit this vulnerability but...
CVE-2026-0760
Foundational Software: Foundation Agents MetaGPT. The CVE-2026-0760 issue is in the deserialize_message function where unvalidated untrusted data can be deserialized, enabling Remote Code Execution with network access and no authentication. Documented impact states an attacker can execute code in...
CVE-2026-0762: Deserialization of Untrusted Data
GPT Academic streamdaas Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Interaction with a malicious DAAS server is required to exploit this vulnerability but...
GPT Academic Code Issues and Vulnerabilities
GPT Academic is an interface developed by binary-husky developers, designed to provide practical interactions for large language models like GPT/GLM. There are code vulnerabilities in GPT Academic; these vulnerabilities stem from the runinsubprocesswrapperfunc function, which lacks validation of...
GPT Academic Code Issues and Vulnerabilities
GPT Academic is an interface developed by binary-husky developers, designed to provide practical interactions for large language models like GPT/GLM. GPT Academic has code vulnerabilities; these vulnerabilities stem from the lack of validation for data provided by users at the upload endpoint,...
CVE-2026-0763: Deserialization of Untrusted Data
GPT Academic runinsubprocesswrapperfunc Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific...
CVE-2026-0764: Deserialization of Untrusted Data
GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific flaw exists within...
MiracleLinux 8 : gdisk-1.0.3-11.el8 (AXSA:2022-4240:03)
The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-4240:03 advisory. gdisk: possible out-of-bounds-write in LoadPartitionTable of gpt.cc CVE-2020-0256 gdisk: possible out-of-bounds-write in ReadLogicalParts of...
CVE-2025-23348
NVIDIA Megatron-LM for all platforms contains a vulnerability in the pretraingpt script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data...
(0Day) GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Interaction with a malicious DAAS server is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the...
(0Day) GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the runinsubprocesswrapperfunc function. The issue results from the lack of proper validati...
PT-2026-1992
Name of the Vulnerable Software and Affected Versions GPT Academic affected versions not specified Description A flaw exists in the stream daas function that allows remote attackers to execute arbitrary code on affected systems. This is due to insufficient validation of user-supplied data, leadin...
PT-2026-1994
Name of the Vulnerable Software and Affected Versions GPT Academic affected versions not specified Description A flaw exists that allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this issue. The vulnerability is...
Low Rank Comes with Low Security: Gradient Assembly Poisoning Attacks against Distributed LoRA-Based LLM Systems
Low-Rank Adaptation LoRA has become a popular solution for fine-tuning large language models LLMs in federated settings, dramatically reducing update costs by introducing trainable low-rank matrices. However, when integrated with frameworks like FedIT, LoRA introduces a critical vulnerability:...
WordPress AI Power: Complete AI Pack plugin <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_prompts vulnerability
Authenticated Admin+ PHP Object Injection via wpaicgexportprompts vulnerability discovered by Tran Anh Duc in WordPress Plugin GPT3 AI Content Writer versions = 1.8.96...
PT-2025-52381
Name of the Vulnerable Software and Affected Versions Hugging Face Transformers megatron gpt2 affected versions not specified Description A flaw exists in the parsing of checkpoints within Hugging Face Transformers megatron gpt2, stemming from insufficient validation of user-supplied data. This c...
Evaluating LLMs for One-Shot Patching of Real and Artificial Vulnerabilities
Automated vulnerability patching is crucial for software security, and recent advancements in Large Language Models LLMs present promising capabilities for automating this task. However, existing research has primarily assessed LLMs using publicly disclosed vulnerabilities, leaving their...
WordPress AI Engine for WordPress: ChatGPT, GPT Content Generator plugin <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read vulnerability
Authenticated Contributor+ Arbitrary File Read vulnerability discovered by Ryan Kozak in WordPress Plugin AI Engine for WordPress: ChatGPT, GPT Content Generator versions = 1.0.1...
CVE-2025-13380: External Control of File Name or Path
The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'lqdaiupdatepost' AJAX endpoint and the use of filegetconten...
