CVE-2026-42205

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class descendants of...

Deserialization of Untrusted Data

Overview ludwig is a Declarative machine learning: End-to-end machine learning pipelines using data-driven configurations. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the model serving process. An attacker can execute arbitrary code on the system by...

Ludwig framework is vulnerable to insecure deserialization through its predict() method.

The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization CWE-502 through its predict method. When a user provides a dataset file path to the predict method, the framework automatically determines the file format. If the file is a pickle .pkl file, it is loaded using...

GHSA-PQ2F-X424-6FJM mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

EUVD-2026-29561

The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization CWE-502 in its model serving component. When starting a model server with the ludwig serve command, the framework loads model weight files using torch.load without enabling the security-restrictive weightsonly=True...

mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

GHSA-XP5Q-5Q7G-Q26R Ludwig framework is vulnerable to insecure deserialization in its model serving component

The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization CWE-502 in its model serving component. When starting a model server with the ludwig serve command, the framework loads model weight files using torch.load without enabling the security-restrictive weightsonly=True...

Ludwig framework is vulnerable to insecure deserialization in its model serving component

The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization CWE-502 in its model serving component. When starting a model server with the ludwig serve command, the framework loads model weight files using torch.load without enabling the security-restrictive weightsonly=True...

EUVD-2026-29562

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

GHSA-WCR3-GM9F-F87Q Ludwig framework is vulnerable to insecure deserialization through its predict() method.

The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization CWE-502 through its predict method. When a user provides a dataset file path to the predict method, the framework automatically determines the file format. If the file is a pickle .pkl file, it is loaded using...

Arbitrary Code Injection

Overview superduper-framework is a Build compositional and declarative AI applications and agents Affected versions of this package are vulnerable to Arbitrary Code Injection in the parseoppart function due to the use of eval on user-supplied input without adequate sanitization or restriction. An...

com.jappyframework:jappy-framework (>=5.6.6, <=5.9.4), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.38) +2 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.0.38)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.38 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.jappyframework:jappy-framework =5.6.6, =5.9.4 -...

com.jalalkiswani:jk-app-web (>=6.2.0, <=6.4.0), com.jalalkiswani:jk-app-webstack (>=6.2.0, <=6.4.0) +9 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.72)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.72 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.jalalkiswani:jk-app-web =6.2.0, =6.2.0, =6.0.0, =6.0.0, =5.2.5, =5.2.5,...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8804 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.54)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-43513 Source advisory: GHSA-5MP6-JRQ3-R938...

com.aceql:aceql-http (>=1.0-beta-1, <=1.0-beta-2), com.soento.framework:framework-web (0.0.1) +3 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (7.0.77)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.77 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.aceql:aceql-http =1.0-beta-1, =1.0-beta-2 -...

com.jappyframework:jappy-framework (>=5.6.6, <=5.9.4), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.38) +2 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (8.0.38)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.38 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.jappyframework:jappy-framework =5.6.6, =5.9.4 -...

com.ajaxjs:aj-common-parent (>=1.4, <=1.5), com.ajaxjs:ajaxjs-framework (>=1.0.8, <=1.1.5) +7 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.5.84)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.84 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.ajaxjs:aj-common-parent =1.4, =1.0.8, =1.1.5 -...

com.jappyframework:jappy-framework (>=5.6.6, <=5.9.4), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.38) +2 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (8.0.38)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.38 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.jappyframework:jappy-framework =5.6.6, =5.9.4 -...

com.jalalkiswani:jk-app-web (>=6.2.0, <=6.4.0), com.jalalkiswani:jk-app-webstack (>=6.2.0, <=6.4.0) +9 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (8.5.72)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.72 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.jalalkiswani:jk-app-web =6.2.0, =6.2.0, =6.0.0, =6.0.0, =5.2.5, =5.2.5,...

com.jappyframework:jappy-framework (>=5.6.6, <=5.9.4), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.38) +2 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (8.0.38)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.38 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.jappyframework:jappy-framework =5.6.6, =5.9.4 -...