476 matches found
MAL-2025-190011 Malicious code in try-phi-lambda-public-validate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f6bcc756a01c3ca9eba1d866d684677df2aef5dd2d72a7a333a92b7bbacde80 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
[SECURITY] Fedora 43 Update: python-cloudpickle-3.1.2-1.fc43
cloudpickle makes it possible to serialize Python constructs not supported by the default pickle module from the Python standard library. cloudpickle is especially useful for cluster computing where Python expressions are shipped over the network to execute on remote hosts, possibly close to the...
Arbitrary Code Execution
Keras is vulnerable to Arbitrary Code Execution. The vulnerability is due to Model.loadmodel not honoring safemode=True when reading legacy .h5/.hdf5 archives and deserializing pickled Lambda-layer code from a crafted model file, which allows an attacker to supply a malicious archive that execute...
Eval Injection
Overview talkpipe is a Python internal and external DSL for writing generative AI analytics Affected versions of this package are vulnerable to Eval Injection due to using the function eval unsafe in the compileLambda function in the talkpipe/util/datamanipulation.py file. An attacker can execute...
CVE-2025-62695
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Stored XSS.This issue affects Mediawiki - WikiLambda Extension: master...
CVE-2025-62695 Stored XSS through system messages
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Stored XSS.This issue affects Mediawiki - WikiLambda Extension: master...
EUVD-2020-0297
Malware in sbrugna...
EUVD-2018-0171
Malware in sbrugna...
EUVD-2025-30277
Malicious code in bioql PyPI...
EUVD-2024-0757
Malicious code in bioql PyPI...
EUVD-2025-30281
Malicious code in bioql PyPI...
EUVD-2024-0566
Malicious code in bioql PyPI...
EUVD-2024-0590
Malicious code in bioql PyPI...
EUVD-2025-0113
Malicious code in bioql PyPI...
EUVD-2023-1884
Malicious code in bioql PyPI...
EUVD-2024-0944
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2025-9905
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Keras Model.loadmodel method can be exploited to achieve arbitrary code execution, even with safemode=True. One can create a specially crafted .h5/.hdf5 mod...
GHSA-77WQ-646F-JRM2 Duplicate Advisory: The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-36rr-ww3j-vrjv. This link is maintained to preserve external references. Original Description The Keras Model.loadmodel method can be exploited to achieve arbitrary code execution, even with safemode=True. One c...
Keras is vulnerable to Deserialization of Untrusted Data
Arbitrary Code Execution in Keras Keras versions prior to 3.11.0 allow for arbitrary code execution when loading a crafted .keras model archive, even when safemode=True. The issue arises because the archive’s config.json is parsed before layer deserialization. This can invoke...
GHSA-36FQ-JGMW-4R9C Keras is vulnerable to Deserialization of Untrusted Data
Arbitrary Code Execution in Keras Keras versions prior to 3.11.0 allow for arbitrary code execution when loading a crafted .keras model archive, even when safemode=True. The issue arises because the archive’s config.json is parsed before layer deserialization. This can invoke...