PT-2026-99916

Name of the Vulnerable Software and Affected Versions Unsloth Zoo versions 2025.9.9 through 2026.8.13 Unsloth versions 2025.9.9 through 2026.8.19 Description A code injection issue exists in the model-loading compile path. The get transformers model type function in hf utils.py collects model typ...

SUSE CVE-2026-90713

A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/src/backend/hf/mod.rs of the component tiktoken vocab File Handler. The manipulation results in denial of service. The attack is only possib...

CVE-2026-90713: Improper Resource Shutdown or Release

A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/src/backend/hf/mod.rs of the component tiktoken vocab File Handler. The manipulation results in denial of service. The attack is only possib...

CVE-2026-86207

An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal only APIs...

CVE-2026-86207 Authentication bypass leads to unauthorised access to N-central

An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal only APIs...

EUVD-2026-72022

An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal only APIs...

Circuit Discovery Helps Detect LLM Jailbreaking: A Mechanistic Interpretability Study

Despite extensive safety alignment, large language models LLMs remain vulnerable to jailbreak attacks that bypass safeguards to elicit harmful content. While prior work attributes this vulnerability to safety training limitations, the internal mechanisms by which LLMs process adversarial prompts...

CVE-2026-46517: Improper Control of Generation of Code

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trustremotecode=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue...

Malicious code in bfx-hf-strategy-perf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac057221646f5043eab6606ba990a3a112afc149c583347e40321643deab7ba The package bfx-hf-strategy-perf was found to contain malicious code. Source: ossf-package-analysis...

MINI-FXXV-37MV-HFHC

Bulletin has no description...

Siemens多款产品 资源管理错误漏洞

Siemens SIMATIC ET 200AL and others are products of Siemens, Germany.Siemens SIMATIC ET 200AL is a distributed I/O system module.Siemens SIMATIC ET 200MP is a modular I/O system module for use in control cabinets for high-density channel applications. Siemens SIMATIC ET 200SP is a distributed I/O...

UBUNTU-CVE-2025-68343

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbreceivebulkcallback: check actuallength before accessing header The driver expects to receive a struct gshostframe in gsusbreceivebulkcallback. Use structgroup to describe the header of the struct gshostframe and...

CVE-2025-68343

CVE-2025-68343 in the Linux kernel affects the can: gs_usb driver (gs_usb_receive_bulk_callback). The vulnerability arises from not validating the actual_length before accessing the gs_host_frame header, risking dereference of an incomplete header. The fix uses struct_group to describe the header...

CVE-2025-48593

In btahfclientcbinit of btahfclientmain.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2025-197910

In btahfclientcbinit of btahfclientmain.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48593

In btahfclientcbinit of btahfclientmain.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48593

A use-after-free vulnerability exists in the bta_hf_client_cb_init function of bta_hf_client_main.cc within the Android Bluetooth subsystem. This flaw is triggered when a phone responds with an error during SDP discovery , causing a tSDP_DISCOVERY_DB to be freed while a dangling pointer remains i...

ASB-A-374746961

In btahfclientcbinit of btahfclientmain.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2025-36782

Malicious code in airbnb-base-hf npm...

Malicious code in airbnb-base-hf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f8ad4bb6eac712ed5b01efbb7a4e455306cdf4f9114c6d604fa49af1f3c1875 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...