CVE-2026-75104 Hugging Face Transformers Path Traversal via Checkpoint Index

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...

CVE-2026-75104

Hugging Face Transformers joins shard filenames from checkpoint index files without validation, allowing malicious index files with parent-directory references or absolute paths to read arbitrary files outside the model directory. CVSS 6.8 (medium) requires local access and user interaction. No p...

EUVD-2026-60384

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...

CVE-2026-75104 Hugging Face Transformers Path Traversal via Checkpoint Index

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...

ANT-2026-H94NCB56 · Leptonica · Heap Buffer Underflow

heap-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-H94NCB56: Heap buffer underflow in...

ANT-2026-ZJXVWQEA · flex · Heap Buffer Overflow

heap-buffer-overflow low Severity Claude low · Security research firm low · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-ZJXVWQEA: Heap buffer overflow in sfinit due to stale...

ANT-2026-9R51NPJC · c-blosc2 · Heap Buffer Overflow

heap-buffer-overflow high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-9R51NPJC: Heap buffer overflow in NDLZ8 triple-mat...

ANT-2026-YQ12XT7Y · openbabel · Heap-buffer-overflow

heap-buffer-overflow high Severity Claude critical · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-YQ12XT7Y: Heap-buffer-overflow in openbabel...

BIT-PYTHON-MIN-2026-6879 Quadratic Behavior in xml.etree.ElementPath Index Predicates

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

BIT-PYTHON-2026-6879 Quadratic Behavior in xml.etree.ElementPath Index Predicates

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

BIT-MONGODB-2026-13055 Server crash via aggregation pipeline expression with compound wildcard index specification

The $internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server mongod. The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an...

BIT-LIBPYTHON-2026-6879 Quadratic Behavior in xml.etree.ElementPath Index Predicates

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

The vulnerability in the driver/block/ublk_drv.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the drivers/block/ublkdrv.c component of the Linux operating system is related to incorrect checking of the specified index, position, or offset in input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100703)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100703 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6thbh: reject oversized option lists struct ip6topts stores at most IP6TOPTSOPTSNR...

SUSE CVE-2026-74457

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...

CVE-2026-74466

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

AZL-96186 CVE-2026-74457 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...

UBUNTU-CVE-2026-74466

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

CVE-2026-74466

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

UBUNTU-CVE-2026-74457

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...