210650 matches found
IBM Langflow OSS code injection vulnerability (CNVD-2026-31204)
IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...
Adobe ColdFusion 2023.x < 2023u22 / 2025.x < 2025u11 Multiple Vulnerabilities (APSB26-82)
The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 22 or 2025.x update 11. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-82 advisory. - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...
The vulnerability of the siman.exe executable file of Rockwell Automation Arena’s discrete event simulation and automation software allows a hacker to execute arbitrary code.
The vulnerability of the siman.exe executable file of Rockwell Automation Arena’s discrete event simulation and automation software is related to the execution of operations beyond the buffer in memory due to incorrect validation of input data. Exploiting this vulnerability can allow an attacker ...
The vulnerability of Windows operating system DHCP clients allows a perpetrator to execute arbitrary code.
The vulnerability of DHCP clients of Windows operating systems relates to the possibility of using memory after it is freed. Exploiting this vulnerability can allow a perpetrator to execute arbitrary code...
The vulnerability of the TorchModuleWrapper.from_config() function in the Keras library allows a hacker to execute arbitrary code.
The vulnerability of the TorchModuleWrapper.fromconfig function in the Keras library is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update (Important) (RHSA-2026:42080)
The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42080 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...
TencentOS Server 2: perl-IO-Compress (TSSA-2026:0652)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0652 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...
CVE-2026-52656
An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a crafted FEX file...
The vulnerability of the linker.exe executable of Rockwell Automation Arena’s discrete event simulation and automation software allows a attacker to execute arbitrary code.
The vulnerability of the linker.exe executable of Rockwell Automation Arena’s event simulation and automation software is related to the execution of operations beyond the buffer boundaries in memory, resulting from incorrect validation of input data. Exploiting this vulnerability allows an...
The vulnerability of the Content Credentials SDK libraries, related to the use of an unreliable search path, allows a perpetrator to execute arbitrary code.
The vulnerability of Content Credentials SDK library libraries is related to the use of an unreliable search path. Exploiting this vulnerability could allow a attacker to execute arbitrary code...
The vulnerability of the camel-pqc component in the Apache Camel Java framework allows a attacker to execute arbitrary code.
The vulnerability of the camel-pqc component in the Apache Camel Java framework is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...
GHSA-V2W2-W228-C444 Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...
DEBIAN-CVE-2026-12484
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...
CVE-2026-12484
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...
CVE-2026-12484
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...
[SECURITY] [DSA 6392-1] tiff security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6392-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 19, 2026 https://www.debian.org/security/faq -...
CVE-2026-12228
A stored cross-site scripting XSS vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms latest version. The endpoint stores attacker-controlled promptcontent into DBDirectMessage.content without server-side sanitization. When a victim opens the direct message DM thread,...
SUSE-SU-2026:22821-1 Security update for vim
This update for vim fixes the following issues: Update to version 9.2.0780. Security issues fixed: - CVE-2026-59856: arbitrary code execution via PHP omni-completion due to improper escaping bsc1271194. - CVE-2026-59857: out-of-bounds write in SAL soundfolding due to improper bounds check...
MiracleLinux 9 : ruby:4.0 (AXSA:2026-1284:01)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1284:01 advisory. ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection CVE-2026-33210 erb: ERB: Arbitrary code execution via...
CVE-2026-48062 CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...