Command Injection via Malicious Model Artifacts

A command injection vulnerability exists in MLflow's model serving container initialization code. When deploying a model with envmanager=LOCAL, MLflow reads dependency specifications from the model artifact's pythonenv.yaml file and directly interpolates them into a shell command without...

Tencent MedicalNet 代码问题漏洞

Tencent MedicalNet is a deep learning pre-trained model library designed for 3D medical imaging by Tencent China. A code issue vulnerability exists in Tencent MedicalNet that stems from a lack of validation of user-supplied data in the generatemodel function, which could lead to deserialization o...

Hugging Face Transformers 代码问题漏洞

Hugging Face Transformers is a Hugging Face open source framework for defining state-of-the-art machine learning models covering textual, visual, audio, and multimodal models for inference and training. A code issue vulnerability exists in Hugging Face Transformers that stems from a lack of...

Explainable AI Agents: Capture LLM Tool Call Reasoning with Spring AI

When building AI agents with tool calling capabilities, developers often need insights into why an LLM chose a particular tool—not just which tool it selected. Understanding the model's reasoning process is important for debugging, observability, and building trustworthy AI systems. Spring AI now...

SemCovert: Secure and Covert Video Transmission Via Deep Semantic-Level Hiding

Video semantic communication, praised for its transmission efficiency, still faces critical challenges related to privacy leakage. Traditional security techniques like steganography and encryption are challenging to apply since they are not inherently robust against semantic-level transformations...

Tencent HunyuanDiT 代码问题漏洞

Tencent HunyuanDiT is a diffusion model from Tencent China. A code issue vulnerability exists in Tencent HunyuanDiT that stems from a lack of validation of user-supplied data in the modelresume function, which could lead to deserialization of untrusted data and remote code execution...

CVE-2025-65857

An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTSP URIs containing hardcoded credentials enabling direct unauthorized video stream access...

CVE-2025-65857

An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTSP URIs containing hardcoded credentials enabling direct unauthorized video stream access...

Malicious code in tiny-model-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a69a5156f95b3b1ddd3a9c0ddd7e1fad0cdd92841e56dc6ea7b950a35a5eb34 The package tiny-model-update was found to contain malicious code. Source: ghsa-malware...

How an LMS Cloud Model Supports Scalable Learning

There's a new era for training and development programs, making the LMS Learning Management System cloud model the…...

CVE-2025-63389

A flaw was found in Ollama. This critical authentication bypass vulnerability allows remote attackers to perform unauthorized model management operations. The platform exposes multiple API endpoints without requiring authentication, enabling attackers to manipulate models without proper...

PT-2025-52634

Name of the Vulnerable Software and Affected Versions Sharp Display Solutions projectors affected versions not specified Sharp Display Solutions NP-P627UL Description A flaw exists in Sharp Display Solutions projectors that allows an attacker to create and run unauthorized firmware. This issue do...

DB Elettronica Screen SFT DAB 600/C 访问控制错误漏洞

The DB Elettronica Screen SFT DAB 600/C is a digital audio broadcast transmitter from DB Elettronica, Italy. An access control error vulnerability exists in the DB Elettronica Screen SFT DAB 600/C version 1.9.3, which stems from weak session management could lead to a device configuration reset...

ReGAIN: Retrieval-Grounded AI Framework for Network Traffic Analysis

Modern networks generate vast, heterogeneous traffic that must be continuously analyzed for security and performance. Traditional network traffic analysis systems, whether rule-based or machine learning-driven, often suffer from high false positives and lack interpretability, limiting analyst...

IoT-Based Android Malware Detection Using Graph Neural Network with Adversarial Defense

Since the Internet of Things IoT is widely adopted using Android applications, detecting malicious Android apps is essential. In recent years, Android graph-based deep learning research has proposed many approaches to extract relationships from applications as graphs to generate graph embeddings...

Quantum-Resistant Cryptographic Models for Next-Gen Cybersecurity

Another threat is the development of large quantum computers, which have a high likelihood of breaking the high popular security protocols because it can use both Shor and Grover algorithms. In order to fix this looming threat, quantum-resistant cryptographic systems, otherwise known as...

CVE-2025-66580

Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. A critical Stored Cross-Site Scripting XSS vulnerability exists in versions prior to 0.11.1 in the Mermaid diagram rendering component. The application allows the execution of arbitrary...

SUSE CVE-2025-63389

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations...

GHSA-24V3-254G-JV85 Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature

Impact Users importing contacts from untrusted sources. Specifically crafted contact data can lead to some of DOM modifications for the link button next to the field e.g. the link address can be overriden. CSS can be manipulated to give the button arbitrary look and change it's size so that any...

EUVD-2025-204579

A security flaw has been discovered in floooh sokol up to 33e2271c431bf21de001e972f72da17a984da932. This vulnerability affects the function sgpipelinecommoninit in the library sokolgfx.h. Performing manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The...