PrivateGPT < 0.5.0 - Open Redirect

An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. id: CVE-2024-5936 info: name:...

GPT Academic v1.3.9 - Open Redirect

An open redirect vulnerability exists in GPT Academic v1.3.9, where the file parameter in the /file= endpoint can be manipulated to redirect users to malicious websites. This could facilitate phishing attacks by tricking users into visiting attacker-controlled URLs. id: CVE-2024-10812 info: name:...

CVE-2026-20345

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion...

EUVD-2026-54507

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion...

CVE-2026-20345

ClamAV's GPT file format parser is affected by memory corruption due to improper endian conversion, causing an out-of-bounds write. An unauthenticated attacker can submit a crafted GPT file to a vulnerable ClamAV scanner, potentially terminating the scanning process and causing a DoS. CVSSv3.1 ba...

EUVD-2026-54301

A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This impacts an unknown function. Such manipulation leads to code injection. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure...

Anthropic’s Opus 5 Is Better at Resisting Prompt Injection

The chart is interesting. On the IPI benchmark, Opus 5 improved over Opus 4.8, reducing the probability of an attacker succeeding within 15 attempts from 5.5% to 2.0%, and from 0.5% to 0.2% on 1 attempt. It also improved on Sonnet 5 5.9% at k=15 and Mythos 5 2.6%, making it the most robust model...

Security update for multipath-tools

This update for multipath-tools fixes the following issues: Update to version 0.9.8+292+suse.c0523c1. kpartx: integer overflow in the GPT partition table size calculation can lead to heap OOB read via crafted USB device or disk imagebsc1268145. kpartx: missing bounds check can lead to a DASD VOL1...

CVE-2026-63766 GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path...

CVE-2026-63766

GPT-SoVITS up to 20250606v2pro is vulnerable to OS command injection in webui.py. The ASR, slice, denoise and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True, allowing attackers to inject shell metacharacters via path parameters t...

EUVD-2025-210474

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page...

CVE-2025-65720

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page...

PT-2026-60309

Name of the Vulnerable Software and Affected Versions GPT Researcher version 3.3.7 Description An issue allows attackers to execute arbitrary commands on a victim system through command injection. This occurs when a user interacts with a specially crafted HTML page, and no authentication is...

CVE-2025-65720

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page...

PYSEC-2026-2501 GPT-Pilot contains a command injection vulnerability in the Executor.run() method

GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 2025-09-03 contains a command injection vulnerability CWE-78 in the Executor.run method. During project execution, when the system prompts the user to confirm or modify a command to be run, it accepts free-text input without proper...

MAL-2026-10284 Malicious code in apps-gpt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e4f318d51a7f0497c7ccda97eb2fbb28071e892d784e3204cb12d9a0b77b4ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PYSEC-2026-1984 Transformers Regular Expression Denial of Service (ReDoS) vulnerability

A Regular Expression Denial of Service ReDoS vulnerability was identified in the huggingface/transformers library, specifically in the file tokenizationgptneoxjapanese.py of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions...

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

A Regular Expression Denial of Service ReDoS vulnerability was identified in the huggingface/transformers library, specifically in the file tokenizationgptneoxjapanese.py of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions...

PYSEC-2026-1289 DB-GPT vulnerable to Cross-Site Request Forgery

In version 0.6.0 of eosphoros-ai/db-gpt, the uvicorn app created by dbgptserver uses an overly permissive instance of CORSMiddleware which sets the Access-Control-Allow-Origin to for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forger...

PYSEC-2026-1290 DB-GPT Uncontrolled Resource Consumption vulnerability

A Denial of Service DoS vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading...