CVE-2025-57622

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loadsrequest.getdata component...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: crossplane-provider-terraform, cloud-sql-proxy, flux-kustomize-controller, trivy, tekton-pipelines-fips, goreleaser, caddy-fips, sops, crossplane-provider-family-aws, vertical-pod-autoscaler-fips, crossplane-provider-aws-servicediscovery, apm-server, pluto, tempo,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: crossplane-provider-terraform, cloud-sql-proxy, flux-kustomize-controller, trivy, tekton-pipelines-fips, goreleaser, caddy-fips, sops, crossplane-provider-family-aws, vertical-pod-autoscaler-fips, crossplane-provider-aws-servicediscovery, apm-server, pluto, tempo,...

Step-Video-T2V 安全漏洞

Step-Video-T2V is an image-to-video model open-sourced by stepfun-ai. There is a security vulnerability in Step-Video-T2V. This vulnerability stems from the use of pickle.loads to process request data in the /vae-api and /caption-api components. It may allow a remote attacker to execute arbitrary...

CVE-2025-57622

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loadsrequest.getdata component...

CVE-2025-57622

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loadsrequest.getdata component...

CVE-2025-57622

CVE-2025-57622 concerns Step-Video-T2V. Public descriptions identify a remote code execution vulnerability exploitable via the /vae-api and /caption-api endpoints, where untrusted request data is deserialized with pickle.loads(), enabling arbitrary code execution. The issue is described across mu...

EUVD-2025-208231

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loadsrequest.getdata component...

CVE-2025-47383

CVE-2025-47383 describes a weak configuration that may cause a cryptographic issue when a VoWiFi call is triggered from UE. Connected records repeat the description and list a CVSS v3.1 base score of 7.2 (HIGH) with NETWORK attack vector, low attack complexity, and high impact on confidentiality,...

CVE-2025-47383 Missing Cryptographic Step in Data Modem

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE...

TraceGuard: Process-Guided Firewall against Reasoning Backdoors in Large Language Models

The deployment of Large Reasoning Models LRMs in high-stakes decision-making pipelines has introduced a novel and opaque attack surface: reasoning backdoors. In these attacks, the model's intermediate Chain-of-Thought CoT is manipulated to provide a linguistically plausible but logically fallacio...

Missing Critical Step in Authentication

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Critical Step in Authentication due to insufficient validation of the authentication Level of Assuran...

PT-2026-21901

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description A time-of-create-to-time-of-use TOCTOU issue allows re-deletion of recently deleted and recreated data sources without authorization. The attack requires specific conditions: admin access to...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: step-ca-fips, flux-kustomize-controller, fulcio, sops, caddy-fips, openfga-fips, rekor, mariadb-operator-fips, trillian-fips, terragrunt-fips, kyverno-fips, prometheus-mysqld-exporter, sqlexporter-fips, flux-kustomize-controller-fips, percona-xtradb-cluster-operator,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: spicedb, cerbos, kyverno-policy-reporter, k3s, terragrunt, apko, kine, ksops, sftpgo-plugin-eventstore, jitsucom-bulker, hydra, step-ca, trufflehog, ratify, telegraf, grafana-alloy, loki, sftpgo, crossplane-provider-sql, dgraph, openfga, sqlexporter, dex,...

Path Traversal in NLTK Downloader Package Metadata Allows Arbitrary File Write

Description The NLTK downloader does not validate file paths constructed from package metadata before writing downloaded files. A malicious NLTK data server can specify arbitrary paths via the subdir and id attributes in the package index XML, allowing arbitrary file write outside the intended...

Missing Cryptographic Step

Overview org.webjars.npm:jsrsasign is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by...

Missing Cryptographic Step

Overview jsrsasign is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be...

12 Step Meeting List < 3.16.6 - Unauthenticated Sensitive Information Exposure

The 12 Step Meeting List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.5.This makes it possible for unauthenticated attackers to extract sensitive user or configuration data via two AJAX endpoints: tsmlinfo and tsmlgeocodes. id:...

CVE-2026-1537

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the loadstep function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to vie...