Wazuh - Unsafe Deserialization Remote Code Execution

A critical Remote Code Execution RCE vulnerability exists in Wazuh server versions = 4.4.0 and = 4.4.0 and 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using...

CVE-2025-3248

CVE-2025-3248 – Execute arbitrary Python code on vulnerable Langflow server. Discovered by: Naveen Sunkavally, Horizon3.ai Status: Public Disclosure Date Reported: 2025-04-07 CVE ID: CVE-2025-3248 🧾 Screenshot 🧩 Summary A critical flaw has been discovered in Langflow that allows malicious actors ...

CVE-2026-33017-PoC-Reverse-Shell

CVE-2026-33017 - Langflow Unauthenticated RCE Exploit 📋 Overview CVE-2026-33017 is an unauthenticated Remote Code Execution RCE vulnerability in Langflow versions This exploit is for educational and authorized testing purposes only. Unauthorized access to computer systems is illegal. Use this too...

(0Day) Meta fairseq split_by_lang Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta fairseq. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the splitbylang.py...

(0Day) Meta fairseq Data2VecAudioModel YAML File Parsing Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta fairseq. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The specific flaw exists within the parsing of configuration files. The issue...

CVE-2026-33017

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote Code Execution PoC ★ https://github.com/user-attachments/assets/562fc637-6be1-4ab9-a396-bfad56447af7 Environment Setup Use the following commands to build and run the vulnerable Langflow environment: docker build -t...

CVE-2025-3248

CVE-2025-3248: Langflow Unauthenticated Remote Code Execution RCE This repository contains two Python scripts: LangflowCheck.py: A scanner that checks for Langflow AI instances vulnerable to CVE-2025-3248. exploit.py: A working reverse shell exploit for vulnerable Langflow targets. Summary...

CVE-2026-57845-hf-datasets-rce

CVE-2026-57845: Hugging Face datasets = 5.1.0 Pandas Pickle RCE Severity: High, CVSS 3.1 8.8 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected: all Hugging Face datasets versions = 5.1.0 Component: datasets.packagedmodules.pandas.pandas CWE: CWE-502 Deserialization of Untrusted Data...

SUSE CVE-2026-119716

pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to...

CVE-2026-119716

pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to...

CVE-2026-119717

Rejected reason: This CVE ID has been rejected as a duplicate...

EUVD-2026-114122

pybars4 through 0.9.13 contains a code injection vulnerability in pybars/compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the...

EUVD-2026-114121

pybars3 through 0.9.7 contains a code injection vulnerability in pybars/compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string litera...

CVE-2026-119578

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algofromjson that allows attackers to run Python code via a crafted work directory's algoobject.json. Attackers can ship a malicious algorithmtemplates module plus a target name that is imported and...

EUVD-2026-113932

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algofromjson that allows attackers to run Python code via a crafted work directory's algoobject.json. Attackers can ship a malicious algorithmtemplates module plus a target name that is imported and...

CVE-2026-119578 MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algofromjson that allows attackers to run Python code via a crafted work directory's algoobject.json. Attackers can ship a malicious algorithmtemplates module plus a target name that is imported and...

CVE-2026-119716: wbond, up9inc: pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/_compiler.py that…

pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to...

PT-2026-133650

Name of the Vulnerable Software and Affected Versions pybars3 versions 0.1.0 through 0.9.7 Description A code injection issue exists in the template compiler within the pybars/ compiler.py file. Template authors can execute arbitrary Python code in the application process by providing crafted...

PT-2026-133651

pybars4 through 0.9.13 contains a code injection vulnerability in pybars/ compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of th...

CVE-2026-119578: Project-MONAI MONAI: MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows…

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algofromjson that allows attackers to run Python code via a crafted work directory's algoobject.json. Attackers can ship a malicious algorithmtemplates module plus a target name that is imported and...