rails-forensics-CVE-2026-66066

rails-forensics-CVE-2026-66066 Tooling and method for answering two questions about a Rails application and CVE-2026-66066, the Active Storage and libvips arbitrary file read known as KindaRails2Shell: 1. Was I vulnerable, and for how long? 2. Was I exploited, and if so, what left the building? T...

CVE-2026-66066

CVE-2026-66066 — KindaRails2Shell Ruby on Rails Active Storage + libvips arbitrary file read → conditional remote code execution RCE PoC tool. Single-file, Python 3.11+ pure standard library with zero dependencies , includes MAT/HDF5 hybrid payloads, a pure-Python PNG pixel decoder, offset reads,...

CVE-2026-9335-keras-hdf5-externallink

CVE-2026-9335 — Keras HDF5 ExternalLink local file-content disclosure Two public Keras APIs — keras.saving.KerasFileEditor and keras.saving.loadweights / model.loadweights — read HDF5 group members by direct indexing without a link-type check. h5py auto-dereferences ExternalLink / SoftLink on...

CVE-2026-0897

CVE-2026-0897 — Google Keras: Denial of Service via HDF5 Shape Bomb in Weight Loading -orange?style=for-the-badge -brightgreen?style=for-the-badge Overview Field| Details ---|--- CVE ID| CVE-2026-0897 Package| keras Google Keras Registry| PyPI Affected Versions| 3.0.0 through 3.13.0 inclusive...

CVE-2026-106547

A flaw was found in HDF5. An attacker could exploit this heap-based buffer overflow by providing a specially crafted HDF5 file to an application. Due to improper metadata validation when reading unallocated dataset chunks, the library writes data past the boundary of an allocated memory buffer...

CVE-2026-19029

A flaw was found in HDF5. When decompressing data using the scale-offset filter, the library fails to verify whether a compressed data chunk is large enough before reading from it. An attacker could exploit this vulnerability by enticing a user or service to process a specially crafted HDF5 file,...

Astra Linux – Vulnerability in hdf5

The HDF5 library from version 1.14.3 has a heap-based buffer overflow issue in the H5Dscattermem function within the H5Dscatgath.c file...

Astra Linux – Vulnerability in hdf5

A SIGFPE signal is raised in the function H5Dcreatechunkfilemaphyper of H5Dchunk.c in the HDF HDF5 through 1.10.3 library during an attempt to parse a crafted HDF file. This occurs due to incorrect protection against division by zero. This could allow a remote denial-of-service attack...

Astra Linux – Vulnerability in hdf5

There is an out-of-bounds write vulnerability in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially crafted GIF file can lead to code execution. An attacker can provide a malicious file to exploit this vulnerability...

CVE-2026-108958

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

CVE-2026-108958

A deserialization vulnerability exists in TensorLayer versions up to 2.2.4 . The flaw is located in the load_hdf5_graph function within the tensorlayer/files/utils.py file of the HDF5 Loading component. By manipulating the model_config argument, an attacker can trigger a deserialization attack. T...

CVE-2026-108958 TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

EUVD-2026-98267

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

CVE-2026-108958 TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

PT-2026-111208

Name of the Vulnerable Software and Affected Versions TensorLayer versions prior to 2.2.5 Description An issue exists in the HDF5 Loading component within the load hdf5 graph function of the tensorlayer/files/utils.py file. A remote attacker can manipulate the model config argument to trigger...

CVE-2026-108958: Deserialization of Untrusted Data

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function loadhdf5graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument modelconfig can lead to deserialization. The attack can be executed remotely. The explo...

CVE-2026-106547 affecting package hdf5 for versions less than 1.14.6-5

CVE-2026-106547 affecting package hdf5 for versions less than 1.14.6-5. A patched version of the package is available...

SUSE CVE-2026-19029

A heap-based buffer over-read in H5Zfilterscaleoffset in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service application crash with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies dnelmts size bytes...

SUSE CVE-2026-106547

A heap-based buffer overflow in H5VMarrayfill in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5Dfillinit fills the fill-value buffer from datatype and...

CVE-2026-19029

A heap-based buffer over-read in H5Zfilterscaleoffset in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service application crash with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies dnelmts size bytes...