Rasa Allows Remote Code Execution via Remote Model Loading

VulnerabilityA vulnerability has been identified in Rasa Pro and Rasa Open Source that enables an attacker who has the ability to load a maliciously crafted model remotely into a Rasa instance to achieve Remote Code Execution.The prerequisites for this are:- The HTTP API must be enabled on the Ra...

SUSE CVE-2026-53080

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsfw: fix NULL dereference of "old" filters before change Like pointed out by Sashiko 1, since commit ed76f5edccc9 "net: sched: protect filterchain list with filterchainlock mutex" TC filters are added to a shared blo...

CVE-2026-53080

A flaw was found in the Linux kernel's traffic control firewall classifier clsfw module. An attacker with the ability to create traffic control filters could exploit a vulnerability where an invalid filter, created using an older method, is processed before proper validation. This can lead to a...

CVE-2026-53080

CVE-2026-53080 affects the Linux kernel net/sched cls_fw. Description in connected advisories shows that a NULL dereference could occur for old-style filters during shared-block publication, leading to a crash/warn during packet classification. The fix skips “old-style” classification on shared b...

EUVD-2026-38948

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsfw: fix NULL dereference of "old" filters before change Like pointed out by Sashiko 1, since commit ed76f5edccc9 "net: sched: protect filterchain list with filterchainlock mutex" TC filters are added to a shared blo...

CVE-2026-53080 net/sched: cls_fw: fix NULL dereference of "old" filters before change()

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsfw: fix NULL dereference of "old" filters before change Like pointed out by Sashiko 1, since commit ed76f5edccc9 "net: sched: protect filterchain list with filterchainlock mutex" TC filters are added to a shared blo...

Deserialization of Untrusted Data

Overview stanza is an A Python NLP Library for Many Human Languages, by the Stanford NLP Group Affected versions of this package are vulnerable to Deserialization of Untrusted Data while loading the lemma classifier due to unsafe fallback to torch.load..., weightsonly=False when the safe load...

esmerald (0.4.0), fast-token-classifier (>=0.1.0, <=0.2.3) +2 more potentially affected by CVE-2026-48818 via starlette (0.23.0)

starlette PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 0.4.0 - fast-token-classifier =0.1.0, =0.2.3 - fastapi 0.90.0 - fastapi-stack-utils 0.8.4 Source cves: CVE-2026-48818 Source advisor...

esmerald (0.4.0), fast-token-classifier (>=0.1.0, <=0.2.3) +2 more potentially affected by CVE-2026-48817 via starlette (0.23.0)

starlette PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 0.4.0 - fast-token-classifier =0.1.0, =0.2.3 - fastapi 0.90.0 - fastapi-stack-utils 0.8.4 Source cves: CVE-2026-48817 Source advisor...

MASCOT-Android: A Curated Dataset and Automated Collection Pipeline for Android Malware Source Code Specimens

Compared with binaries and decompiled code, malware source code more directly reflects the attackers' original intent. However, the scarcity of source code and the high cost of manual review make such datasets difficult to build and maintain. We propose MASCOT-Android, a curated dataset of Androi...

CVE-2026-20256

Splunk Enterprise (versions &lt; 10.2.4, 10.0.7, 9.4.12, 9.3.13) and Splunk Cloud Platform (versions

GHSA-32G3-35G9-WC9G @hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Affected: @hulumi/drift 1.4.0 — Fixed in: 1.4.0 — Severity: Medium — CWE-755 Improper Handling of Exceptional Conditions Summary @hulumi/drift runs four adapters that each ask a different question about whether a resource has drifted Pulumi-state diff, provider-version change, CloudTrail event,...

@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Affected: @hulumi/drift 1.4.0 — Fixed in: 1.4.0 — Severity: Medium — CWE-755 Improper Handling of Exceptional Conditions Summary @hulumi/drift runs four adapters that each ask a different question about whether a resource has drifted Pulumi-state diff, provider-version change, CloudTrail event,...

Splunk Enterprise 输入验证错误漏洞

Splunk Cloud Platform and Splunk Enterprise are both products of the American company Splunk. Splunk Cloud Platform is a powerful service for data collection, processing, and analysis. Splunk Enterprise is a suite of software for data collection and analysis. There is an input validation...

PT-2026-72726

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The flow classifier in the network scheduler uses the addr fold function for fields missing from packet headers. When operating in map mode, userspace can control the mask, xor, rshift,...

PT-2026-48478

Name of the Vulnerable Software and Affected Versions @hulumi/drift versions prior to 1.4.0 Description An issue exists in the classifier of the drift detection toolkit where it only evaluates the detected field of adapters and ignores whether the adapter itself succeeded. This leads to two...

OPENSUSE-SU-2026:20928-1 Security update for syft

This update for syft fixes the following issues: Changes in syft: - Update to version 1.45.0: Added Features - Add support for ZapAddOns as jar files 4654 4932 @douglasclarke - MySQL binary classifier should distinguish between MySQL Cluster ndb and MySQL 3297 4907 @witchcraze - Catalog...

Hiding in Plain Floats: Steganographic Carriers for Indirect Prompt and Content Injection

Text-centered prompt-injection defenses assume that the malicious signal is visible in one of the inspected text views. We study a reproducible LLM01-style indirect prompt/content-injection failure mode where that assumption breaks: a payload caught in plain English slips past the same detector...

CVE-2026-31224

The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability CWE-502 in the MultitaskClassifier.load method of the MultitaskClassifier class. The method loads model weight files using torch.load without enabling the security-restrictive weightsonly=True parameter. This...

esmerald (0.4.0), fast-token-classifier (>=0.1.0, <=0.2.3) +2 more potentially affected by CVE-2026-48710 via starlette (0.23.0)

starlette PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 0.4.0 - fast-token-classifier =0.1.0, =0.2.3 - fastapi 0.90.0 - fastapi-stack-utils 0.8.4 Source cves: CVE-2026-48710 Source advisor...