CVE-2025-30354

Summary: CVE-2025-30354 affects Bruno, an open source API IDE. A bug in the assertion runtime can cause expressions to run in Developer Mode, causing sandbox settings to be ignored when a single request is executed, specifically when importing collections from untrusted or malicious sources. It r...

CVE-2025-30354 Bruno ignores Safe-Mode in Asserts expressions

Bruno is an open source IDE for exploring and testing APIs. A bug in the assertion runtime caused assert expressions to run in Developer Mode, even if Safe Mode was selected. The bug resulted in the sandbox settings to be ignored for the particular case where a single request is run/sent. This...

PT-2025-14117 · Bruno · Bruno

Name of the Vulnerable Software and Affected Versions: Bruno versions prior to 1.39.1 Description: A bug in the assertion runtime of Bruno, an open source IDE for exploring and testing APIs, caused assert expressions to run in Developer Mode even when Safe Mode was selected. This resulted in the...

CVE-2025-26619

A Cross-site scripting vulnerability was found in the Vega library for Node.js. In affected versions, it is possible to call JavaScript functions from the Vega expression language that were not meant to be supported. Mitigation Run vega without vega.expressionInterpreter. Alternatively, using the...

DEBIAN-CVE-2025-26619

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In vega 5.30.0 and lower and in vega-functions 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be...

CVE-2025-26619

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In vega 5.30.0 and lower and in vega-functions 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be...

UBUNTU-CVE-2025-26619

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In vega 5.30.0 and lower and in vega-functions 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be...

CVE-2025-26619

Vega (Node) and Vega‑functions prior to versions 5.31.0/5.16.0 allow calling JavaScript functions from the Vega expression language that were not meant to be supported. This is the CVE-2025-26619 issue; the root cause is exposure of arbitrary JS execution through the expression interpreter. The v...

SUSE CVE-2002-0985

Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA e.g. sendmail in the 5th argument to mail, altering MTA behavior and possibly executing commands...

PYSEC-2025-122

The Keras Model.loadmodel function permits arbitrary code execution, even with safemode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, ...

PYSEC-2025-122

The Keras Model.loadmodel function permits arbitrary code execution, even with safemode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, ...

AZL-58360 CVE-2025-1550 affecting package keras for versions less than 3.3.3-2

The Keras Model.loadmodel function permits arbitrary code execution, even with safemode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, ...

Deserialization of Untrusted Data

Overview keras is a Keras is a high-level neural networks API for Python.. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the loadmodel function, which uses pickle for serialization. An attacker can execute code even if safemode is set to True, by supplyi...

CVE-2025-1550

CVE-2025-1550 concerns a vulnerability in Keras where the Model.load_model function can execute arbitrary code via a malicious .keras archive that alters config.json to load modules/functions with crafted arguments. The issue persists even with safe_mode enabled, enabling potential code execution...

Keras 代码注入漏洞

Keras is a multi-backend deep learning framework open-sourced by Keras. Keras suffers from a code injection vulnerability that stems from allowing execution of arbitrary code via a manually constructed malicious keras archive, even in safe mode...

CVE-2025-1302

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...

CVE-2022-47578

An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions b...

PT-2025-32526 · Keras +1 · Keras +1

Name of the Vulnerable Software and Affected Versions: Keras versions 3.0.0 through 3.10.0 Description: A safe mode bypass vulnerability exists in the Model.load model method. This allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted .keras model...

The vulnerability of the secure kernel mode of Windows operating systems allows attackers to enhance their privileges.

The vulnerability of the Windows operating system’s safe mode relates to the swapping of a non-trusted pointer. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the secure kernel mode of Windows operating systems allows attackers to enhance their privileges.

The vulnerability of the Windows operating system’s safe mode is related to access control deficiencies. Exploiting this vulnerability can allow attackers to enhance their privileges...