41300 matches found
CVE-2026-58474 whichllm < 0.5.16 Code Injection via run and snippet commands
whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...
CVE-2026-58474
whichllm before version 0.5.16 contains a code injection vulnerability in the run and snippet commands. The script generation function in cli.py interpolates HuggingFace-derived values—including GGUF variant filenames from the Hub API siblings rfilename field—directly into Python source code with...
CVE-2026-58474 whichllm < 0.5.16 Code Injection via run and snippet commands
whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...
CVE-2026-79249
A flaw was found in Google Chrome's Bisection component. This code injection vulnerability allows a remote attacker to obtain sensitive information by tricking a user into processing a specially crafted file. This could lead to unauthorized access to confidential data...
Malicious Package
Overview dumb-binding-gyp-package is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Multiple vulnerabilities in CorvusSKK
Overview CorvusSKK provided by SASAKI Nobuyuki contains multiple vulnerabilities listed below: Code Injection CWE-94 - CVE-2026-76148 Integer Overflow or Wraparound CWE-190 - CVE-2026-76149 Ryo Shimada of Powder Keg Technologies, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with...
CVE-2026-76148
CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product...
CVE-2026-76148
CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product...
CVE-2026-76148
CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product...
CVE-2026-76148
CorvusSKK is affected by a code injection vulnerability that may allow an attacker to achieve arbitrary code execution on the target system. The attack vector is local, requires user interaction, and needs no prior privileges, with high impact on confidentiality, integrity, and availability (CVSS...
CVE-2026-76148
CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product...
CVE-2026-76148
CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product...
Linux Distros Unpatched Vulnerability : CVE-2026-79249
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Code injection in Bisection in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted file. Chromium...
SSTImap 1.4
SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to be used as an interactive penetration testing tool for SSTI detection...
PT-2026-81932
CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product...
PT-2026-82234
Name of the Vulnerable Software and Affected Versions whichllm versions prior to 0.5.16 Description A code injection issue exists in the run and snippet commands. A remote attacker controlling a HuggingFace repository can achieve arbitrary code execution by crafting a malicious GGUF filename...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104758)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104758 advisory. Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client...
CVE-2026-58474: Improper Control of Generation of Code
whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...
CVE-2026-76148: Improper Control of Generation of Code
CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product...