2716 matches found
MAL-2026-10376 Malicious code in sixseven4 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dfd6ff82b27df8c8ecd3520e70b720e0ff6e6f4443e21d1230acebdfd032b6d The package declares no install/postinstall/preinstall lifecycle scripts, and its declared main is sw.js — a browser ServiceWorker that uses...
PT-2026-59951
Impact The UnbatchGradOp function takes an argument id that is assumed to be a scalar. A nonscalar id can trigger a CHECK failure and crash the program. python import numpy as np import tensorflow as tf id is not scalar tf.raw ops.UnbatchGradoriginal input= tf.constant1,batch index=tf.constant0,0...
PT-2026-59783
Impact nn ops.fractional avg pool v2 and nn ops.fractional max pool v2 require the first and fourth elements of their parameter pooling ratio to be equal to 1.0, as pooling on batch and channel dimensions is not supported. python import tensorflow as tf import os import numpy as np from...
PT-2026-60021
Summary A Server Side Request Forgery SSRF vulnerability in download bytes from url allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions. This can be used to target...
PT-2026-59815
Impact The UnbatchGradOp function takes an argument id that is assumed to be a scalar. A nonscalar id can trigger a CHECK failure and crash the program. python import numpy as np import tensorflow as tf id is not scalar tf.raw ops.UnbatchGradoriginal input= tf.constant1,batch index=tf.constant0,0...
PT-2026-59928
Impact nn ops.fractional avg pool v2 and nn ops.fractional max pool v2 require the first and fourth elements of their parameter pooling ratio to be equal to 1.0, as pooling on batch and channel dimensions is not supported. python import tensorflow as tf import os import numpy as np from...
PT-2026-59384
Summary Any authenticated user can overwrite any file's content by ID through the POST /api/v1/retrieval/process/files/batch endpoint. The endpoint performs no ownership check, so a regular user with read access to a shared knowledge base can obtain file UUIDs via GET /api/v1/knowledge/id/files a...
Incorrect Authorization
Overview FlaskBB is an A classic Forum Software in Python using Flask. Affected versions of this package are vulnerable to Incorrect Authorization via manipulation of the topicid parameter in batch requests. An attacker can perform unauthorized actions such as locking, unlocking, deleting, or...
CVE-2026-22659
FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted...
PT-2026-57162
FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted...
PYSEC-2026-3121 Out of bounds read in Tensorflow
Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batchdim and can result in a heap OOB read: python import tensorflow as tf @tf.function def test: y = tf.rawops.ReverseSequence input = 'aaa','bbb', seqlengths = 1,1,1, seqdim = -10, batchdim = -...
nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows
SummaryOn Windows, converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a inkscape.bat file that defines a Windows batch script, capable of arbitrary code execution.When a user runs jupyter nbconvert --to pdf on a...
PYSEC-2026-1091 Aim Relative Path Traversal vulnerability
A vulnerability in the runs/delete-batch endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file or directory deletion through path traversal. The endpoint does not mitigate path traversal when handling user-specified run-names, which are used to specify log/metadata files for deletion...
TensorFlow has double free in Fractional(Max/Avg)Pool
Impactnnops.fractionalavgpoolv2 and nnops.fractionalmaxpoolv2 require the first and fourth elements of their parameter poolingratio to be equal to 1.0, as pooling on batch and channel dimensions is not supported.pythonimport tensorflow as tfimport osimport numpy as npfrom tensorflow.python.ops...
TensorFlow vulnerable to `CHECK` failures in `UnbatchGradOp`
ImpactThe UnbatchGradOp function takes an argument id that is assumed to be a scalar. A nonscalar id can trigger a CHECK failure and crash the program.pythonimport numpy as npimport tensorflow as tf id is not scalartf.rawops.UnbatchGradoriginalinput= tf.constant1,batchindex=tf.constant0,0,0 , ,...
CVE-2026-21370
Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values...
CVE-2026-21370 Out-of-bounds Write in Camera Driver
Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values...
CVE-2026-21370
Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values...
CVE-2026-21370
CVE-2026-21370 is an out-of-bounds write in the camera driver causing memory corruption when validating input batch size and buffer plane count that exceed maximum allowed values. The issue is described as a memory corruption condition in the Qualcomm camera driver. Exploitation details beyond wh...
