CVE-2026-109227

SGLang versions through 0.5.21 are vulnerable to an unbounded memory allocation vulnerability within the preprocess_video function in qwen_vl.py. The root cause is that the system decodes video frames at their full source resolution before applying max_pixels limits. A remote attacker can exploit...

PT-2026-67349

Name of the Vulnerable Software and Affected Versions huggingface/transformers versions prior to 5.8.0.dev0 Description An issue allows arbitrary file writes through path traversal, a technique used to access files and directories outside the intended folder. The flaw exists in the save pretraine...