PT-2026-40125

Name of the Vulnerable Software and Affected Versions Ludwig framework versions prior to 0.10.5 Description The model serving component is subject to insecure deserialization. When initiating a model server via the ludwig serve command, the framework utilizes the torch.load function to load model...

CVE-2026-31238

The Ludwig framework (up to 0.10.4) is vulnerable to insecure deserialization (CWE-502) in its model serving component. Starting a model server (ludwig serve) loads model weight files with torch.load() without enabling weights_only=True, allowing deserialization of arbitrary Python objects via pi...

CVE-2026-31237

The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization CWE-502 through its predict method. When a user provides a dataset file path to the predict method, the framework automatically determines the file format. If the file is a pickle .pkl file, it is loaded using...

WordPress Elementor Contact Form DB plugin <= 2.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by You Ludwig in WordPress Plugin Elementor Contact Form DB versions = 2.1.3...

CVE-2026-24388

Missing Authorization vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMasterToolKit: from n/a through = 2.14.0...

EUVD-2023-27908

Malicious code in bioql PyPI...

A Bootiful Podcast: Micrometer.io lead Tommy Ludwig on the latest-and-greatest in observability for the Spring developer

Hi, Spring fans! In this episode, I talk to Micrometer.io lead Tommy Ludwig on the latest-and-greatest in observability for the Spring developer...

CVE-2023-23822

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ludwig Media UTM Tracker plugin = 1.3.1 versions...

ludwig-burgsmueller.de Improper Access Control vulnerability OBB-3819280

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ludwig-seibel.com Improper Access Control vulnerability OBB-3804090

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ludwig-klages.de Improper Access Control vulnerability OBB-3776796

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

A Bootiful Podcast: Micrometer lead Tommy Ludwig

Hi, Spring fans! In this installment, Josh Long talks to Micrometer lead Tommy Ludwig, recorded from beautiful Barcelona, Spain during the fabulous Spring I/O event!...

CVE-2023-23822

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ludwig Media UTM Tracker plugin = 1.3.1 versions...

CVE-2023-23822

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ludwig Media UTM Tracker plugin = 1.3.1 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ludwig Media UTM Tracker plugin = 1.3.1 versions...

CVE-2023-23822 WordPress UTM Tracker Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ludwig Media UTM Tracker plugin = 1.3.1 versions...

CVE-2023-23822

CVE-2023-23822 affects the WordPress plugin UTM Tracker (Ludwig Media)

ludwig-walkenhorst.de Cross Site Scripting vulnerability OBB-3265247

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ludwig-schoen.de Cross Site Scripting vulnerability OBB-3265246

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress WooCommerce Multiple Customer Addresses & Shipping Plugin < 21.7 is vulnerable to Insecure Direct Object References (IDOR)

Software WooCommerce Multiple Customer Addresses & Shipping Type Plugin Vulnerable versions 21.7 Fixed in 21.7 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-0865 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID...