EUVD-2026-53366

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

CVE-2026-71281 peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

CVE-2026-71281 peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

CVE-2026-71279

CVE-2026-71279 : Zigbee2MQTT’s ExternalJSExtension.getFilePath() uses path.join(basePath, name) on a name supplied via MQTT without sanitization. This allows path traversal (e.g., "../../tmp/evil.js") to escape the extensions directory and, after validating the suffix (.js/.mjs/.cjs) and writing ...

Malicious code in hubert-verify-primary-email-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6b673dd1185ee4ae8ee19ec605dc7f25eebf55c0583be7c5cb878d331e70db3 [email protected] presents itself as an email-verification library but on require of index.js loads init.js, which reconstructs...

CVE-2026-71279 Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a name parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. Because path.join resolves ../ sequences,...

CVE-2026-71279 Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a name parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. Because path.join resolves ../ sequences,...

EUVD-2026-53364

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a name parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. Because path.join resolves ../ sequences,...

CVE-2026-71278 rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation

rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary script field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication. The stored scri...

CVE-2026-71278

The rust-iot-platform contains an unauthenticated endpoint to create a calc rule (POST /calc-rule/create) where a user-supplied script field is stored and later evaluated with quick_js::Context::eval() without sandboxing. Because this route bypasses the AuthToken guard, an unauthenticated attacke...

CVE-2026-71269

CVE-2026-71269 affects Node-RED’s local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js). The vulnerability arises because GET/POST requests to /library/:lib/:type/*path join the user-sup...

CVE-2026-71269 Node-RED Library API Path Traversal Leading to Arbitrary File Read/Write

Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...

EUVD-2026-53354

Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...

CVE-2026-71268

OpenPLC Runtime v3 is affected by a path traversal in compile_program() (webserver/openplc.py): it processes directives of the form (FILE:path content ) and writes to os.path.join('./core', file_path) without validating that file_path stays under ./core. A crafted ST file like (FILE:../../../etc/...

EUVD-2026-53353

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses FILE:path content directives from uploaded Structured Text .st program files and writes the referenced content to os.path.join'./core', filepath with no validation that filepath stays within the ./core directory. A crafted ....

CVE-2026-71268 OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses FILE:path content directives from uploaded Structured Text .st program files and writes the referenced content to os.path.join'./core', filepath with no validation that filepath stays within the ./core directory. A crafted ....

EUVD-2026-53347

IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...

CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py: if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl. Because and binds tighter than or, any file: URI passes validation regardless of netloc. Th...

CVE-2026-71259

ESPHome (up to 2026.7.0-dev) is affected by an operator-precedence bug in the cv.url() validator within esphome/config_validation.py. The condition if parsed.scheme and parsed.netloc or parsed.scheme == "file" incorrectly permits file:// URIs to bypass validation, affecting the url: field of the ...

CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py: if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl. Because and binds tighter than or, any file: URI passes validation regardless of netloc. Th...