13353 matches found
PT-2026-53623
Impact TorchServe's check on allowed urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which...
PT-2026-53484
The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument. This argument is intended to allow users to provide custom Python function definitions. However, the tool directly executes the provided code using the unsafe exec function...
MINI-336V-2P5R-P25P
Bulletin has no description...
MINI-PC3G-V2R8-483H
Bulletin has no description...
MINI-54CM-R33F-X95C
Bulletin has no description...
EUVD-2026-39997
A security flaw has been discovered in yashpokharna2555 restaurent-management-system. This impacts an unknown function of the file loginregister.php of the component Registration Handler. Performing a manipulation of the argument Username results in cross site scripting. The attack may be initiat...
CVE-2026-13499 yashpokharna2555 restaurent-management-system Registration login_register.php cross site scripting
A security flaw has been discovered in yashpokharna2555 restaurent-management-system. This impacts an unknown function of the file loginregister.php of the component Registration Handler. Performing a manipulation of the argument Username results in cross site scripting. The attack may be initiat...
MINI-736W-FPRF-CR59
Bulletin has no description...
MINI-895G-WX6R-H8QW
Bulletin has no description...
MINI-X735-FFMP-F2XH
Bulletin has no description...
MINI-8C8G-2P36-FH46
Bulletin has no description...
MINI-22P2-MM66-3MJQ
Bulletin has no description...
MINI-888P-X978-25P8
Bulletin has no description...
MINI-M9WF-X529-736P
Bulletin has no description...
Malicious code in db-rake (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a0d966d760dca0783a79eb150639ccfaf01aac944481e793dbcb7d7669983c When a consumer imports db-rake and constructs any Model, the package's resetor method silently runs npm install db-dx-connector unpinned, no-save:...
Malicious code in db-plog (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 961a6a108104105727b81399e6a3a6d56636cb79ae8fbfbbc33528f90d890d99 On every Model instantiation — the package's documented primary API — dist/index.js executes execSync'npm install db-connector-log --no-warnings...
MAL-2026-6538 Malicious code in db-plog (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 961a6a108104105727b81399e6a3a6d56636cb79ae8fbfbbc33528f90d890d99 On every Model instantiation — the package's documented primary API — dist/index.js executes execSync'npm install db-connector-log --no-warnings...
EUVD-2026-37951
mcp-pinot: Unauthenticated tool invocation via default oauthenabled=False + host 0.0.0.0 bind...
Debug Messages Revealing Unnecessary Information
Overview backpropagate is a Production-ready headless LLM fine-tuning with smart defaults, Windows support, and modular architecture Affected versions of this package are vulnerable to Debug Messages Revealing Unnecessary Information in the authentication process. An attacker can gain unauthorize...