CVE-2026-108958

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

CVE-2026-108961 PaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.__init__ code injection

A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.init of the file paddlex/inference/models/textdetection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possib...

CVE-2026-108960 Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds

A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function createstripedmattogpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulation results in out-of-bounds read. The...

CVE-2026-108960

A vulnerability exists in Tiiny-AI PowerInfer (up to commit 8bd56d69906c9d2dba4d3bf6899763401e01a9a4) within the FFN GPU-split Loader component. Specifically, the create_striped_mat_to_gpu function in the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu is susceptible to an out-of-bounds read . ...

CVE-2026-108960 Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds

A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function createstripedmattogpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulation results in out-of-bounds read. The...

CVE-2026-108959 itsourcecode Online Cake Ordering System addtransacdetail.php sql injection

A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /addtransacdetail.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-108959 itsourcecode Online Cake Ordering System addtransacdetail.php sql injection

A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /addtransacdetail.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-109786

In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter config/filter.d/sshd.conf accepts an "on " suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as "x VICTIM-SOURCE-IP-ADDRESS on" to make...

CVE-2026-108958 TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

EUVD-2026-98267

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

CVE-2026-108958

A deserialization vulnerability exists in TensorLayer versions up to 2.2.4 . The flaw is located in the load_hdf5_graph function within the tensorlayer/files/utils.py file of the HDF5 Loading component. By manipulating the model_config argument, an attacker can trigger a deserialization attack. T...

CVE-2026-108958 TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

CVE-2026-108947

A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function loadckpt of the file torchdistill/common/mainutil.py. Executing a manipulation of the argument srcckpt can lead to deserialization. The attack needs to be launched locally. The exploit has been...

CVE-2026-108957 TinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_tinyllava.py _load_text_config code injection

A security flaw has been discovered in TinyLLaVA TinyLLaVAFactory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function loadtextconfig of the file tinyllava/model/configurationtinyllava.py of the component TinyLlavaConfig. Performing a manipulation of the argument...

CVE-2026-108956 code-projects Online Reviewer System User Update btn_functions.php sql injection

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launch...

EUVD-2026-98235

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launch...

CVE-2026-108956

A SQL injection vulnerability exists in the code-projects Online Reviewer System 1.0 within the User Update Handler component. The flaw is located in an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php. This vulnerability can be exploited remotely to mani...

CVE-2026-108956 code-projects Online Reviewer System User Update btn_functions.php sql injection

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launch...

CVE-2026-108955

A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function ggufinitfromfile of the file ggml.c of the component GGUF Parser. This manipulation of the argument dataoffset causes out-of-bounds read. The attack requires local access...

CVE-2026-108954

The k2-fsa sherpa-onnx software (up to version 1.13.8 ) contains a buffer overflow vulnerability in the Offline Transducer Greedy Search Decoder component. Specifically, the OfflineTransducerGreedySearchDecoder::Decode function in sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc fails...