CVE-2026-109786

In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter config/filter.d/sshd.conf accepts an "on " suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as "x VICTIM-SOURCE-IP-ADDRESS on" to make...

CVE-2026-108958 TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

EUVD-2026-98267

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

CVE-2026-108958

A deserialization vulnerability exists in TensorLayer versions up to 2.2.4 . The flaw is located in the load_hdf5_graph function within the tensorlayer/files/utils.py file of the HDF5 Loading component. By manipulating the model_config argument, an attacker can trigger a deserialization attack. T...

CVE-2026-108958 TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

CVE-2026-108947

A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function loadckpt of the file torchdistill/common/mainutil.py. Executing a manipulation of the argument srcckpt can lead to deserialization. The attack needs to be launched locally. The exploit has been...

CVE-2026-108957 TinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_tinyllava.py _load_text_config code injection

A security flaw has been discovered in TinyLLaVA TinyLLaVAFactory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function loadtextconfig of the file tinyllava/model/configurationtinyllava.py of the component TinyLlavaConfig. Performing a manipulation of the argument...

CVE-2026-108956 code-projects Online Reviewer System User Update btn_functions.php sql injection

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launch...

EUVD-2026-98235

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launch...

CVE-2026-108956

A SQL injection vulnerability exists in the code-projects Online Reviewer System 1.0 within the User Update Handler component. The flaw is located in an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php. This vulnerability can be exploited remotely to mani...

CVE-2026-108956 code-projects Online Reviewer System User Update btn_functions.php sql injection

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launch...

CVE-2026-108955

A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function ggufinitfromfile of the file ggml.c of the component GGUF Parser. This manipulation of the argument dataoffset causes out-of-bounds read. The attack requires local access...

CVE-2026-108954

The k2-fsa sherpa-onnx software (up to version 1.13.8 ) contains a buffer overflow vulnerability in the Offline Transducer Greedy Search Decoder component. Specifically, the OfflineTransducerGreedySearchDecoder::Decode function in sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc fails...

CVE-2026-108954 k2-fsa sherpa-onnx Offline Transducer Greedy Search Decoder offline-transducer-greedy-search-decoder.cc Decode buffer overflow

A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc of the component Offline Transducer Greedy Search Decoder. The manipulation of the...

CVE-2026-108944

A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. Affected by this vulnerability is the function getobjfromstr of the file src/utils/modelutils.py of the component Config-Driven Model Instantiation. Such manipulation of the argument Targe...

CVE-2026-108945

A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. Performing a manipulation of the argument imgsz/names/kptshape results...

CVE-2026-108948 code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes

A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Profile Update Handler. The manipulation of the argument usertypeid leads to...

CVE-2026-108947 yoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization

A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function loadckpt of the file torchdistill/common/mainutil.py. Executing a manipulation of the argument srcckpt can lead to deserialization. The attack needs to be launched locally. The exploit has been...

CVE-2026-108947

A deserialization vulnerability exists in yoshitomo-matsubara torchdistill versions up to 1.1.5 . The flaw is located within the load_ckpt function in the torchdistill/common/main_util.py file. An attacker can trigger deserialization by manipulating the src_ckpt argument. This attack requires loc...

CVE-2026-108947

A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function loadckpt of the file torchdistill/common/mainutil.py. Executing a manipulation of the argument srcckpt can lead to deserialization. The attack needs to be launched locally. The exploit has been...