333 matches found
PT-2025-51329
Name of the Vulnerable Software and Affected Versions Autodesk products affected versions not specified Description A specially designed MODEL file can cause a memory corruption issue when processed by certain Autodesk products. A malicious actor could potentially use this issue to run code witho...
PT-2025-51330
Name of the Vulnerable Software and Affected Versions Autodesk AutoCAD affected versions not specified Description A specially crafted MODEL file can trigger an Out-of-Bounds Write issue when processed by specific Autodesk products. Successful exploitation could allow an attacker to cause a crash...
PT-2025-51333
Name of the Vulnerable Software and Affected Versions Autodesk AutoCAD affected versions not specified Description A specially crafted MODEL file can trigger an Out-of-Bounds Write issue when processed by specific Autodesk products. Successful exploitation could allow a malicious actor to cause a...
CVE-2025-14568
A security vulnerability has been detected in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This impacts an unknown function of the file model/User.php. The manipulation of the argument employeeid/id/admin leads to sql injection. The attack can be initiated...
Remote Command Execution
scio-pypi is vulnerable to Remote Command Execution. The vulnerability is due to torch.load executing unsafe deserialization even when weightsonly=True, which allows an attacker to craft malicious model files that trigger arbitrary code execution during loading...
EUVD-2025-36707
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw...
Directory Traversal
Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Directory Traversal via improper validation of user-supplied paths...
CVE-2025-11201 MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw...
MLflow 路径遍历漏洞
MLflow is an open source platform from MLflow that simplifies machine learning development, including tracking experiments, packaging code into repeatable runs, and sharing and deploying models. MLflow suffers from a path traversal vulnerability that stems from improper handling of model file...
EUVD-2024-20674
Malicious code in bioql PyPI...
EUVD-2022-36924
Malicious code in bioql PyPI...
EUVD-2024-22285
Malicious code in bioql PyPI...
EUVD-2024-22287
Malicious code in bioql PyPI...
EUVD-2025-25170
Malicious code in bioql PyPI...
EUVD-2025-6784
Malicious code in bioql PyPI...
EUVD-2024-25098
Malicious code in bioql PyPI...
EUVD-2024-22283
Malicious code in bioql PyPI...
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of model file paths. The issue results from the lack of proper...
Linux Distros Unpatched Vulnerability : CVE-2021-44961
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory leakage flaw exists in the class PerimeterGenerator of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. Specially crafted stl files can exhaust...
CVE-2025-50461
A deserialization vulnerability exists in Volcengine's verl 3.0.0, specifically in the scripts/modelmerger.py script when using the "fsdp" backend. The script calls torch.load with weightsonly=False on user-supplied .pt files, allowing attackers to execute arbitrary code if a maliciously crafted...