EUVD-2026-42271

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function asyncruncommand of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd results in command injection. Attacking locally is a requirement...

CVE-2026-15035

Bentoml OpenLLM 0.6.30 is affected by a command-injection in async_run_command (src/openllm/common.py, Model Repository Directory Name Handler). The vulnerability stems from manipulation of the cmd argument, enabling local exploitation. Public exploit details exist, and attack requires local acce...

MINI-RP7P-6356-J7HC

Bulletin has no description...

MINI-2X2F-XHRX-76MM

Bulletin has no description...

MINI-PRX2-X2XH-C7M6

Bulletin has no description...

CVE-2026-12479

A flaw was found in Keras, specifically in the model saving and loading library. This path traversal vulnerability occurs due to improper handling of user-provided layer names, which allows an attacker to craft a malicious Keras model. When this model is saved or loaded, it can escape its intende...

CVE-2026-5757

A flaw was found in Ollama's model quantization engine. An unauthenticated remote attacker can exploit this vulnerability to read and exfiltrate the server's heap memory. This could lead to sensitive data exposure, further compromise of the system, and allow for stealthy persistence within the...

ECHO-400A-1B13-AE60

Bulletin has no description...

CVE-2026-24698

Cisco RV130/RV130W routers (firmware 1.0.3.55 ) and RV110W routers (firmware 1.2.2.5 / 1.2.2.8 ) are vulnerable to an OS command injection vulnerability. The flaw exists within the save_syslog_to_file() function of the httpd binary due to improper sanitization of the model_name configuration para...

UTT nv518G gohead/sub_448384 component buffer overflow vulnerability

UTT nv518G is an enterprise-level network switch produced by the UTT company in China. The UTT nv518G has a buffer overflow vulnerability in its gohead/sub448384 component. Attackers can exploit this vulnerability to cause a denial-of-service attack...

PT-2026-56665

Name of the Vulnerable Software and Affected Versions Drupal AI SEO/GEO Analyzer versions 0.0.0 through 1.1.3 Description Stored Cross-site Scripting XSS occurs when the module generates SEO/GEO analysis reports by sending entity content, including comments, to a Large Language Model LLM. The...

CVE-2026-24698

An OS command injection vulnerability exists in the savesyslogtofile function of the "httpd" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The modelname configuration parameter is not properly sanitized, which could allow an authenticated...

CVE-2026-24698

An OS command injection vulnerability exists in the savesyslogtofile function of the "httpd" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The modelname configuration parameter is not properly sanitized, which could allow an authenticated...

PT-2026-56417

Name of the Vulnerable Software and Affected Versions bentoml OpenLLM version 0.6.30 Description Command injection is possible within the Model Repository Directory Name Handler component. This occurs when the cmd argument is manipulated in the async run command function located in the...

AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076

The AI SEO/GEO Analyzer module generates SEO/GEO analysis reports by sending content of an entity including its comments to an LLM, then converts the model's Markdown response to HTML and stores it for display to privileged users. The generated HTML was rendered without passing through Drupal's...

Exploit for Command Injection in Litellm

─── CVE-2026-42271 ─── 🛡️ AMN SECURITY 🛡️ مركز أ...

CGA-772P-X4VG-PM67

Bulletin has no description...

CVE-2026-58473

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

CVE-2026-58473 Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

EUVD-2026-42095

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...