8913 matches found
Federated Learning and Interoperability Platform security vulnerabilities
Federated Learning and Interoperability Platform is an open-source medical imaging learning platform developed by the London AI Centre. Versions of the Federated Learning and Interoperability Platform FLIP prior to 0.1.1 contained security vulnerabilities. These vulnerabilities stemmed from the...
CVE-2026-33879: Improper Restriction of Excessive Authentication Attempts
Federated Learning and Interoperability Platform FLIP is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no rate limiting or CAPTCHA, enabling brute-force and...
colornet (0.2.0), keras-metric-learning (0.2.0) +5 more potentially affected by CVE-2026-33682 via streamlit (0.53.0)
streamlit PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - colornet 0.2.0 - keras-metric-learning 0.2.0 - neural-art 0.2.0 - openleveldb 0.1.0 - punditkit 0.0.2 - pyraytracer 0.2.0 - pytorchjeeves 0.2...
CVE-2026-31914
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hookandhook WP Courses LMS wp-courses allows DOM-Based XSS.This issue affects WP Courses LMS: from n/a through = 3.2.26...
CVE-2026-3962
A vulnerability was identified in Jcharis Machine-Learning-Web-Apps up to a6996b634d98ccec4701ac8934016e8175b60eb5. The impacted element is the function rendertemplate of the file Machine-Learning-Web-Apps-master/Build-n-Deploy-Flask-App-with-Waypoint/app/app.py of the component Jinja2 Template...
CVE-2026-4573
A security vulnerability has been detected in SourceCodester Simple E-learning System 1.0. This affects an unknown part of the file /includes/formhandlers/deletepost.php of the component HTTP GET Parameter Handler. The manipulation of the argument postid leads to sql injection. It is possible to...
CVE-2026-30881
Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoint. The parameters datestart and dateend from $REQUEST are embedded directly into a raw SQL string without proper sanitization. Although Database::escapestrin...
CVE-2026-4484
The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepareobjectfordatabase' function. This makes it possible for...
CVE-2026-4484 Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator
The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepareobjectfordatabase' function. This makes it possible for...
PT-2026-28184
The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepare object for database' function. This makes it possible for...
colornet (0.2.0), keras-metric-learning (0.2.0) +5 more potentially affected by CVE-2026-33682 via streamlit (0.53.0)
streamlit PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlit and may be impacted: - colornet 0.2.0 - keras-metric-learning 0.2.0 - neural-art 0.2.0 - openleveldb 0.1.0 - punditkit 0.0.2 - pyraytracer 0.2.0 - pytorchjeeves 0.2...
EUVD-2026-15899
Incorrect Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects Creator LMS: from n/a through = 1.1.18...
CVE-2026-32530 WordPress Creator LMS plugin <= 1.1.18 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects Creator LMS: from n/a through = 1.1.18...
CVE-2026-31914
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hookandhook WP Courses LMS wp-courses allows DOM-Based XSS.This issue affects WP Courses LMS: from n/a through = 3.2.26...
Machine Learning Operations: Yesterday, Today, and Tomorrow
...
PT-2026-28044
Incorrect Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects Creator LMS: from n/a through = 1.1.18...
Walma: Learning to See Memory Corruption in WebAssembly
WebAssembly's Wasm monolithic linear memory model facilitates memory corruption attacks that can escalate to cross-site scripting in browsers or go undetected when a malicious host tampers with a module's state. Existing defenses rely on invasive binary instrumentation or custom runtimes, and do...
Toward a Multi-Layer ML-Based Security Framework for Industrial IoT
The Industrial Internet of Things IIoT introduces significant security challenges as resource-constrained devices become increasingly integrated into critical industrial processes. Existing security approaches typically address threats at a single network layer, often relying on expensive hardwar...
CVE-2026-4573
A security vulnerability has been detected in SourceCodester Simple E-learning System 1.0. This affects an unknown part of the file /includes/formhandlers/deletepost.php of the component HTTP GET Parameter Handler. The manipulation of the argument postid leads to sql injection. It is possible to...
CVE-2026-4574 SourceCodester Simple E-learning System User Profile Update sql injection
A vulnerability was detected in SourceCodester Simple E-learning System 1.0. This vulnerability affects unknown code of the component User Profile Update Handler. The manipulation of the argument firstName results in sql injection. It is possible to launch the attack remotely. The exploit is now...