Hardcoded trust_remote_code=True in Model Implementations Bypasses User Security Control

This report is not public...

Kestrel

Kestrel LLM-Assisted Bug Bounty Hunting Platform for Kali L...

CVE-2025-68856

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in keeswolters Mopinion Feedback Form mopinion-feedback-form allows DOM-Based XSS.This issue affects Mopinion Feedback Form: from n/a through = 1.1.1...

CVE-2026-24949 WordPress PhotoMe theme <= 5.7.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGoods PhotoMe photome allows DOM-Based XSS.This issue affects PhotoMe: from n/a through = 5.7.1...

CVE-2025-69368 WordPress SOHO - Photography WordPress Theme theme <= 3.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GT3themes SOHO - Photography WordPress Theme soho allows DOM-Based XSS.This issue affects SOHO - Photography WordPress Theme: from n/a through = 3.0.3...

CVE-2025-69367 WordPress Oyster - Photography WordPress Theme theme <= 4.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GT3themes Oyster - Photography WordPress Theme oyster allows DOM-Based XSS.This issue affects Oyster - Photography WordPress Theme: from n/a through = 4.4.3...

CVE-2026-2824

A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub441CF4 of the file /cgi-bin/mbox-config?method=SET&section=pingconfig of the component webmggnt. Executing a manipulation of the argument destination can lead to command injection. The attack may be performed from remote...

CVE-2026-0875

A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...

CVE-2026-2473: Generation of Predictable Numbers or Identifiers

Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to but not including 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictabl...

PT-2026-21291

Name of the Vulnerable Software and Affected Versions Google Cloud Vertex AI versions 1.21.0 through 1.132.9 Description A flaw exists in Vertex AI Experiments within Google Cloud Vertex AI that could allow a remote, unauthenticated attacker to execute code, steal models, and poison data. This is...

PT-2026-21056

Name of the Vulnerable Software and Affected Versions calliko NPS computy versions through 2.8.2 Description The software contains a flaw related to improper input handling during web page generation, specifically a DOM-Based Cross-site Scripting issue. This allows for potential execution of...

PT-2026-21115

Name of the Vulnerable Software and Affected Versions Mopinion Feedback Form versions through 1.1.1 Description The Mopinion Feedback Form software contains a flaw related to improper input handling during web page generation, specifically a DOM-Based Cross-site Scripting issue. This allows for t...

PT-2026-21233

Name of the Vulnerable Software and Affected Versions ThemeGoods PhotoMe versions through 5.7.1 Description The software contains a flaw related to improper input handling during web page generation, leading to a DOM-Based Cross-site Scripting XSS condition. This allows for potential malicious co...

PT-2026-21290

Name of the Vulnerable Software and Affected Versions Google Cloud Vertex AI SDK google-cloud-aiplatform versions 1.98.0 through 1.130.9 Description A Stored Cross-Site Scripting XSS issue exists in the genai/ evals visualization component of Google Cloud Vertex AI SDK. This allows an...

Automatic, Expressive, and Scalable Fuzzing with Stitching

Fuzzing is a powerful technique for finding bugs in software libraries, but scaling it remains difficult. Automated harness generation commits to fixed API sequences at synthesis time, limiting the behaviors each harness can test. Approaches that instead explore new sequences dynamically lack the...

GitLab Enterprise Edition Authentication Bypass

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition is related to the absence of authentication procedures. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the AI model...

GitLab Enterprise Edition Authentication Bypass

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition is related to the absence of authentication procedures. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the AI model...

PT-2026-21113

Name of the Vulnerable Software and Affected Versions harman79 ID Arrays versions through 2.1.2 Description The software contains a flaw related to improper input handling during web page generation, leading to a DOM-Based Cross-site Scripting XSS condition. This allows for the potential executio...

Autodesk Shared Components < 2026.6 Multiple Vulnerabilities (adsk-sa-2026-0004)

The version of Autodesk Shared Components installed on the remote Windows host is prior to 2026.6. It is, therefore, affected by multiple out-of-bounds write vulnerabilities: - A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write...

org.keycloak:keycloak-account-freemarker (1.0-alpha-2), org.keycloak:keycloak-login-freemarker (1.0-alpha-2) +1 more potentially affected by CVE-2026-2733 via org.keycloak:keycloak-services (1.0-alpha-2)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-alpha-2 - org.keycloak:keycloak-login-freemarker...