120 matches found
CVE-2026-113786 pypdf: Unvalidated JPEG image data loading
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow...
CVE-2026-59229
The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...
EUVD-2026-107167
The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...
CVE-2026-59229 Apache IoTDB: Legacy Pipe Privilege Escalation
The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...
CVE-2026-59229
The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...
CVE-2026-59229
Apache IoTDB versions 2.0.0 through 2.0.10 are vulnerable to a privilege escalation issue in the Legacy Pipe receiver protocol (specifically the handshake and sendPipeData functions). The root cause is the use of a hardcoded SUPER_USER (root) identity when executing data loading and deletion oper...
CVE-2026-59229 Apache IoTDB: Legacy Pipe Privilege Escalation
The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...
PT-2026-120524
The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPER USER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USE PIPE or MAINTAIN who does NOT have WRITE DATA or DELETE DATA permissions on target databas...
Apache IoTDB security vulnerabilities
A security vulnerability exists in Apache IoTDB versions 2.0.0 through 2.0.11. This vulnerability arises because the Legacy Pipe receive protocol handshake/sendPipeData utilizes a hard-coded SUPERUSER root identity for data loading and deletion operations. Users possessing only SYSTEM-level...
Security Bulletin: IBM Engineering Lifecycle Optimization - Engineering Publishing affected by a Cross-Site Scripting (XSS) vulnerability in Bootstrap (CVE-2024-6485)
Summary A security vulnerability CVE-2024-6485 has been identified in Bootstrap that may affect IBM Engineering Lifecycle Optimization - Engineering Publishing. The vulnerability exists in the button plugin's data-loading-text attribute, where improper input neutralization could allow attackers t...
Astra Linux – Vulnerability in twitter-bootstrap3
A security vulnerability has been discovered in Bootstrap that could enable Cross-Site Scripting XSS attacks. The vulnerability is related to the “data-loading-text” attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into this attribute,...
Security Bulletin: Due to use of bootstrap, IBM License Key Server Administration and Reporting Tool is affected by Cross-site scripting
Summary IBM License Key Server Administration and Reporting Tool uses bootstrap javascript library internally. Vulnerability Details CVEID:CVE-2025-1647 DESCRIPTION: Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Bootstrap allows...
Security Bulletin: IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities in bootstrap-3.4.1.tgz client library
Summary Vulnerabilities have been identified in bootstrap-3.4.1.tgz , which is used in IBM Engineering Lifecycle Management -Engineering Workflow Management Vulnerability Details CVEID:CVE-2024-6484 DESCRIPTION: Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript i...
NVIDIA DALI Deserialization RCE
The vulnerability of the library for acceleration of data loading and preprocessing in NVIDIA DALI is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code...
Cleanlab Deserialization of Untrusted Data vulnerability
Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded...
PYSEC-2026-597
NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue 3504. The UNSAFENOPROTOCOLRE regex in nltk/data.py checks for literal ../ sequences but fails to account for percent-encoded traversal sequences such as ..%2f. The url2pathname function decodes...
CVE-2026-24215
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend, where an attacker could cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service...
PT-2026-45457
An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load with unrestricted deserialization...
EUVD-2026-31053
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend, where an attacker could cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service...