May 12, 2026-KB5087054 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 24H2

None None...

May 12, 2026-Security and Quality Rollup for .NET Framework 4.8 for Windows Server 2012 (KB5087067)

None None...

May 12, 2026-KB5087051 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 25H2 and Microsoft server operating system 24H2

None None...

May 12, 2026-Security and Quality Rollup for .NET Framework 3.5 for Windows Server 2012 R2 (KB5087049)

None None...

May 12, 2026-Security and Quality Rollup for .NET Framework 3.5 for Windows Server 2012 (KB5087048)

None None...

May 12, 2026-KB5087055 Cumulative Update for .NET Framework 4.8.1 for Windows 11, version 26H1

None None...

Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel

A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The...

CVE-2026-41712 ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

PT-2026-40126

Name of the Vulnerable Software and Affected Versions mamba versions prior to 2.2.7 Description Insecure deserialization occurs when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.from pretrained function uses torch.load to load the pytorch model.bin weight file without...

PT-2026-40124

Name of the Vulnerable Software and Affected Versions Ludwig framework versions prior to 0.10.5 Description Insecure deserialization occurs through the predict method. When a dataset file path is provided to this method, the framework automatically determines the file format. If a pickle .pkl fil...

EFW Framework 安全漏洞

EFW Framework is an enterprise-level web development framework developed by the efw group, based on Ajax and server-side JavaScript. Versions of the EFW Framework prior to 4.08.010 contained security vulnerabilities. These vulnerabilities stemmed from the previewServlet not performing content...

EFW Framework 安全漏洞

EFW Framework is an enterprise-level web development framework developed by the efw group, based on Ajax and server-side JavaScript. Versions of the EFW Framework prior to 4.08.010 contained security vulnerabilities. These vulnerabilities stemmed from the fact that the “readonly” flag only...

CVE-2026-31237

The Ludwig framework (up to version 0.10.4) is reported to be vulnerable to insecure deserialization (CWE-502) in its predict() function. If a user supplies a dataset file path to predict(), Ludwig attempts to determine the file format and, when encountering a pickle (.pkl) file, loads it via pan...

SAP SAPUI5 安全漏洞

SAP SAPUI5 is a JavaScript application framework developed by the German company SAP. There is a security vulnerability in SAP SAPUI5, which allows unauthenticated attackers to manipulate specific URL parameters containing malicious content. This could lead victims to clicking on and accessing...

Micronaut Framework 资源管理错误漏洞

The Micronaut Framework is a modern full-stack Java framework based on the JVM, developed by the Micronaut Foundation. Versions of the Micronaut Framework prior to 4.10.22 contained a resource management vulnerability. This vulnerability stemmed from the use of unbounded caching in the bundleCach...

Micronaut Framework 资源管理错误漏洞

The Micronaut Framework is a modern full-stack Java framework based on the JVM, developed by the Micronaut Foundation. Versions of the Micronaut Framework from 4.3.0 to 4.10.22 contained a resource management vulnerability. This vulnerability stemmed from TimeConverterRegistrar caching...

CVE-2026-31238

The Ludwig framework (up to 0.10.4) is vulnerable to insecure deserialization (CWE-502) in its model serving component. Starting a model server (ludwig serve) loads model weight files with torch.load() without enabling weights_only=True, allowing deserialization of arbitrary Python objects via pi...

CVE-2026-31226

The TinyZero project thru commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839 2025-58-24 contains a critical command injection vulnerability CWE-78 in its HDFS file operation utilities. The vulnerability arises from the unsafe construction and execution of shell commands via os.system without proper...

CVE-2026-31224

The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability CWE-502 in the MultitaskClassifier.load method of the MultitaskClassifier class. The method loads model weight files using torch.load without enabling the security-restrictive weightsonly=True parameter. This...