mcpuniverse (>=1.0.0, <=1.1.3), mseep-mcpuniverse (1.0.4) potentially affected by CVE-2026-66004 via blender-mcp (1.1.3)

blender-mcp PYPI version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on blender-mcp and may be impacted: - mcpuniverse =1.0.0, =1.1.3 - mseep-mcpuniverse 1.0.4 Source cves: CVE-2026-66004 Source advisory: OSV:PYSEC-2026-4203...

CLEANSTART-2024-EN97769 Endless Infinite loop in Blender-thumnailing due to logical bugs

Security vulnerability affects the blender package. Endless Infinite loop in Blender-thumnailing due to logical bugs...

CLEANSTART-2024-UY34199 flaw was found in Blender 3

Security vulnerability affects the blender package. A flaw was found in Blender 3...

CLEANSTART-2024-AJ31493 flaw was found in Blender 3

Security vulnerability affects the blender package. A flaw was found in Blender 3...

Malicious code in buenlder (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

[SECURITY] Fedora 45 Update: blender-5.2.2-2.fc45

Blender is the essential software solution you need for 3D, from modeling, animation, rendering and post-production to interactive creation and playback...

Astra Linux – Vulnerability in Blender

An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, potentially allowing an attacker to read sensitive data using a crafted DDS image file. This flaw affects Blender versions prior to 2.83.19, 2.93.8, and 3.1...

Astra Linux – Vulnerability in Blender

A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service, memory corruption, or potentially code execution...

Astra Linux – Vulnerability in Blender

An integer overflow in the processing of loaded 2D images leads to a “write-what-where” vulnerability and an “out-of-bounds read” vulnerability. This allows attackers to leak sensitive information or execute code within the Blender process when a specially crafted image file is loaded. This flaw...

argus-server (>=1.0.0, <=1.1.1), ariadne-extended (>=0.1.0, <=0.1.12) +117 more potentially affected by CVE-2026-15830 via django (3.0.14)

django PYPI version 3.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - argus-server =1.0.0, =0.1.0, =0.18.0, =2.8.0, =0.4.0, =3.0.1, =0.7.1, =0.2.0, =2.0.3, =3.0.1 and more Source cves: CVE-2026-15830 Source advisory:...

mcpuniverse (>=1.0.0, <=1.1.3), mseep-mcpuniverse (1.0.4) potentially affected by CVE-2026-66004 via blender-mcp (1.1.3)

blender-mcp PYPI version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on blender-mcp and may be impacted: - mcpuniverse =1.0.0, =1.1.3 - mseep-mcpuniverse 1.0.4 Source cves: CVE-2026-66004 Source advisory: GHSA-4H8Q-HH2J-755W...

mcpuniverse (>=1.0.0, <=1.1.3), mseep-mcpuniverse (1.0.4) potentially affected by CVE-2026-66004 via blender-mcp (1.1.3)

blender-mcp PYPI version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on blender-mcp and may be impacted: - mcpuniverse =1.0.0, =1.1.3 - mseep-mcpuniverse 1.0.4 Source cves: CVE-2026-66004 Source advisory: OSV:GHSA-4H8Q-HH2J-755W...

mcpuniverse (>=1.0.0, <=1.1.3), mseep-mcpuniverse (1.0.4) potentially affected by CVE-2026-66004 via blender-mcp (1.1.3)

blender-mcp PYPI version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on blender-mcp and may be impacted: - mcpuniverse =1.0.0, =1.1.3 - mseep-mcpuniverse 1.0.4 Source cves: CVE-2026-66004 Source advisory: MEND:CVE-2026-66004...

CVE-2026-66004

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the downloadpolyhavenasset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...

blender-5.2-5.2.0-1.1 on GA media (moderate)

blender-5.2-5.2.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11288-1 Rating: moderate Cross-References: CVE-2022-0544 CVE-2022-0545 CVE-2022-0546 Affected Products: openSUSE Tumbleweed An update that solves 3 vulnerabilities can now be installed. Description: These are all security issues...

OPENSUSE-SU-2026:11288-1 blender-5.2-5.2.0-1.1 on GA media

These are all security issues fixed in the blender-5.2-5.2.0-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-60103

Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted .blend file with a malicious signed short memberindex value in the SDNA block. The memberindex field is used as an array index into...

CVE-2026-60103

A flaw was found in Blender. A remote attacker could exploit an out-of-bounds read vulnerability by providing a specially crafted .blend file. This vulnerability occurs when the application processes a malicious memberindex value without proper validation, leading to an attempt to access memory...

CVE-2026-60103

Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted .blend file with a malicious signed short memberindex value in the SDNA block. The memberindex field is used as an array index into...

CVE-2026-60103

Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted .blend file with a malicious signed short memberindex value in the SDNA block. The memberindex field is used as an array index into...