CVE-2026-5236

A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument npresentations leads to heap-based buffer overflow. The attack needs to be performed...

CVE-2026-5236 Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based overflow

A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument npresentations leads to heap-based buffer overflow. The attack needs to be performed...

CVE-2026-5235 Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-based overflow

A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641. This impacts the function AP4BitReader::ReadCache of the file Ap4Dac4Atom.cpp of the component MP4 File Parser. This manipulation causes heap-based buffer overflow. The attack needs to be launched locally. The exploit has been...

CVE-2026-32286 vulnerabilities

Vulnerabilities for packages: grafana-alloy, kots, teleport, splunk-otel-collector-fips, bento, bento-fips, grafana-alloy-fips, steampipe, telegraf, splunk-otel-collector...

CVE-2026-32286 vulnerabilities

Vulnerabilities for packages: grafana-alloy, splunk-otel-collector, kots, bento, steampipe, telegraf...

CVE-2026-4427 vulnerabilities

Vulnerabilities for packages: hydra, grafana-alloy, telegraf, splunk-otel-collector, kots, harbor, bento, migrate, trillian, steampipe, src, flyte, teleport...

GHSA-X6GF-MPR2-68H6 vulnerabilities

Vulnerabilities for packages: hydra, grafana-alloy, telegraf, splunk-otel-collector, kots, harbor, bento, migrate, trillian, steampipe, src, flyte, teleport...

GHSA-JQCQ-XJH3-6G23 vulnerabilities

Vulnerabilities for packages: grafana-alloy, splunk-otel-collector, kots, bento, steampipe, telegraf...

CVE-2026-4427 vulnerabilities

Vulnerabilities for packages: grafana-alloy, wavefront-collector-for-kubernetes, argo-workflows-fips, gotrue-fips, gotrue, kots, teleport-operator-fips, vault-fips, vault, bento, src, ory-kratos-fips, steampipe, trillian-fips, argo-workflows, flyte, hydra-fips, harbor-fips, hydra,...

GHSA-X6GF-MPR2-68H6 vulnerabilities

Vulnerabilities for packages: grafana-alloy, wavefront-collector-for-kubernetes, argo-workflows-fips, gotrue-fips, gotrue, kots, teleport-operator-fips, vault-fips, vault, bento, src, ory-kratos-fips, steampipe, trillian-fips, argo-workflows, flyte, hydra-fips, harbor-fips, hydra,...

GHSA-JQCQ-XJH3-6G23 vulnerabilities

Vulnerabilities for packages: grafana-alloy, kots, teleport, splunk-otel-collector-fips, bento, bento-fips, grafana-alloy-fips, steampipe, telegraf, splunk-otel-collector...

CVE-2026-33744

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the docker.systempackages field in bentofile.yaml accepts arbitrary strings that are interpolated directly into Dockerfile RUN commands without sanitization. Since...

PT-2026-28523

Name of the Vulnerable Software and Affected Versions BentoML versions prior to 1.4.37 Description BentoML is a Python library used for building online serving systems for AI applications and model inference. A flaw exists where the docker.system packages field within the bentofile.yaml file does...

CVE-2026-27905 BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safeextracttarfile function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path,...

BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction

Arbitrary File Write via Symlink Path Traversal in Tar Extraction Summary The safeextracttarfile function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path, not the symlink's target. An attacker can create a...

CVE-2026-24123

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate,...

CVE-2026-24123

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate,...

EUVD-2026-4723

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate,...

GHSA-6R62-W2Q3-48HF BentoML has a Path Traversal via Bentofile Configuration

Summary BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate, conda.environmentyml. An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files fr...

BentoML path traversal vulnerability

BentoML is an open-source model service library developed by BentoML. It is used to build high-performance and scalable artificial intelligence applications using Python. Versions of BentoML prior to 1.4.34 contained a path traversal vulnerability. This vulnerability stemmed from the bentofile.ya...