onyx-agent

Onyx Agent v68 Multi-LLM agent framework for security testing...

CVE-2026-31239: Deserialization of Untrusted Data

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

The vulnerability of the ImportedPlugin.importCommunityItemFromUrl() function in the LLM system’s runtime and management framework allows a malicious actor to execute arbitrary code.

The vulnerability of the ImportedPlugin.importCommunityItemFromUrl function in the LLM system is related to an incorrect restriction on the path name of the catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

vLLM 安全漏洞

vLLM is a high throughput and memory efficient inference and service engine for LLM from vLLM open source. A security vulnerability exists in vLLM version 0.5.5 through versions prior to 0.11.1, which stems from insufficient validation of the chattemplatekwargs parameter, and may result in API...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the torch.load function within the Checkpoint.loadcheckpoint method without restrictions. Details Serialization is a process of converting an object into a sequence of bytes which can be persisted t...

The vulnerability of the Model I/O framework in the macOS operating system, allowing a hacker to execute arbitrary code.

The vulnerability of the Model I/O framework in the macOS operating system is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...