6057 matches found
PT-2026-53436
Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the post install...
PT-2026-53489
The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.from pretrained method uses torch.load to load the pytorch model.bin weight file without enabling the security-restrictive...
Missing Authentication For Critical Function
Backpropagate is vulnerable to Missing Authentication for Critical Function. The vulnerability is due to the Reflex web UI failing to enforce the --auth authentication mechanism despite indicating it is enabled, which allows an attacker who can access the exposed UI port to perform unauthorized...
CVE-2026-57473
A vulnerability exists in the netclient and factory services of Reolink Home Hub versions prior to v3.3.0.45626031911 due to the possibility of brute-force cracking the credentials. This issue could allow attackers on the same local network to intercept traffic between the Hub and associated...
CVE-2026-57473
A vulnerability exists in the netclient and factory services of Reolink Home Hub versions prior to v3.3.0.45626031911 due to the possibility of brute-force cracking the credentials. This issue could allow attackers on the same local network to intercept traffic between the Hub and associated...
CVE-2026-57473
A vulnerability exists in the netclient and factory services of Reolink Home Hub versions prior to v3.3.0.45626031911 due to the possibility of brute-force cracking the credentials. This issue could allow attackers on the same local network to intercept traffic between the Hub and associated...
CVE-2026-57473
The CVE affects Reolink Home Hub netclient and factory services, prior to v3.3.0.456_26031911. The issue enables brute-force credential cracking on the local network, allowing an attacker on the same LAN to intercept traffic between the Hub and connected cameras and compromise camera credentials....
CVE-2026-57473
A vulnerability exists in the netclient and factory services of Reolink Home Hub versions prior to v3.3.0.45626031911 due to the possibility of brute-force cracking the credentials. This issue could allow attackers on the same local network to intercept traffic between the Hub and associated...
EUVD-2026-39646
A vulnerability exists in the netclient and factory services of Reolink Home Hub versions prior to v3.3.0.45626031911 due to the possibility of brute-force cracking the credentials. This issue could allow attackers on the same local network to intercept traffic between the Hub and associated...
CVE-2018-9139
creationtimestamp| type| source ---|---|--- 2026-06-26 01:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp5smrhot42n...
CVE-2026-57473: Use of Weak Credentials
A vulnerability exists in the netclient and factory services of Reolink Home Hub versions prior to v3.3.0.45626031911 due to the possibility of brute-force cracking the credentials. This issue could allow attackers on the same local network to intercept traffic between the Hub and associated...
PT-2026-52691
A vulnerability exists in the netclient and factory services of Reolink Home Hub versions prior to v3.3.0.456 26031911 due to the possibility of brute-force cracking the credentials. This issue could allow attackers on the same local network to intercept traffic between the Hub and associated...
GO-2026-5141 Beszel has an IDOR in hub API endpoints that read system ID from URL parameter in github.com/henrygd/beszel
Beszel has an IDOR in hub API endpoints that read system ID from URL parameter in github.com/henrygd/beszel...
GHSA-MX8G-39Q3-5C79 vulnerabilities
Vulnerabilities for packages: argo-workflows, gitlab-rails-ce, kubeflow-katib, gitlab-rails-ce-fips, arangodb...
MAL-2026-6433 Malicious code in rstreams-shard-util (npm)
The rstreams-shard-util npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the...
CVE-2026-54157 LobeHub: Unauthenticated SSRF in `/webapi/proxy`
LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make...
GHSA-HCXC-WF8J-23HV vulnerabilities
Vulnerabilities for packages: grafana-fips, grafana, commercial-grafana...
MAL-2026-6279 Malicious code in forge-jsx4 (npm)
forge-jsx4 is a remote access trojan RAT published to the public npm registry by the account rafaelsilva [email protected]. Versions 1.0.122 and 1.0.123 were published on June 21-22, 2026 as a reconstitution of the forge-jsx / forge-jsxy campaign, reusing the same command-and-control...
Malicious code in forge-jsx4 (npm)
forge-jsx4 is a remote access trojan RAT published to the public npm registry by the account rafaelsilva [email protected]. Versions 1.0.122 and 1.0.123 were published on June 21-22, 2026 as a reconstitution of the forge-jsx / forge-jsxy campaign, reusing the same command-and-control...
