CVE-2026-79784 Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiateclass in vocos/pretrained.py takes the classpath value from the configuration, splits it into a module and an attribute, imports the module with import, resolves the attribute with...

EUVD-2026-65542

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiateclass in vocos/pretrained.py takes the classpath value from the configuration, splits it into a module and an attribute, imports the module with import, resolves the attribute with...

CVE-2026-79784 Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiateclass in vocos/pretrained.py takes the classpath value from the configuration, splits it into a module and an attribute, imports the module with import, resolves the attribute with...

CVE-2026-79784

Vocos (through 0.1.0 ), a Python library maintained by gemelo-ai, suffers from arbitrary code execution via an unrestricted class_path field in its model configuration. The vulnerable function instantiate_class in vocos/pretrained.py uses __import__ and getattr on a user-supplied dotted path with...

CVE-2026-14457 RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted...

CVE-2026-14457

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted...

Low: Red Hat Security Advisory: httpd security update

An update for httpd is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CVE-2026-21754

HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sensitive data exposure within internal communications...

CVE-2026-16723

A flaw was found in fastjson. This remote code execution RCE vulnerability allows a remote attacker to execute arbitrary code on the system. The vulnerability is exploitable under fastjson's default configuration, meaning no special setup or AutoType enablement is required for exploitation...

CVE-2026-21754

HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities that could enable unauthorized lateral movement , container breakout , and sensitive data exposure within internal communications. The CVSS 3.1 base score is 5.4 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R...

CVE-2026-21754 HCL Hive is affected by multiple security vulnerabilities.

HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sensitive data exposure within internal communications...

EUVD-2026-65469

HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sensitive data exposure within internal communications...

CVE-2026-63587

The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically...

EUVD-2026-65343

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

EUVD-2026-65329

The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically...

CVE-2026-67578

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...

CVE-2026-67578

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...

CVE-2026-67578

The Furuno FA-50 (all versions) has a missing authentication flaw affecting certain configuration parameters. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter configuration without authentication. The CVSS 3.1 score is 7.5 (HIGH) with ...

EUVD-2026-65318

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...

Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure

Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated remote attacker to retrieve sensitive information due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and...