CVE-2026-34445

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr function to load metadata like file paths or data lengths directly from an ONNX model file. It didn’t check if the...

UBUNTU-CVE-2026-34445

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr function to load metadata like file paths or data lengths directly from an ONNX model file. It didn’t check if the...

CVE-2026-34445

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr function to load metadata like file paths or data lengths directly from an ONNX model file. It didn’t check if the...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview onnx is an Open Neural Network Exchange Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the ExternalDataInfo function. An attacker can cause system unavailability, limited information disclosure, or dat...

CVE-2026-34445

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr function to load metadata like file paths or data lengths directly from an ONNX model file. It didn’t check if the...

CVE-2026-34445 ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr function to load metadata like file paths or data lengths directly from an ONNX model file. It didn’t check if the...

CVE-2026-34445 ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr function to load metadata like file paths or data lengths directly from an ONNX model file. It didn’t check if the...

freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2()

A null pointer dereference has been discovered in FreeRDP. A NULL pointer dereference vulnerability in rdpwritelogoninfov2 allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0...

PT-2026-29828

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.5.87 Description The PraisonAI Gateway server lacks authentication for WebSocket connections at the /ws endpoint and exposes agent topology at the /info endpoint without authentication. This allows any network...

PT-2026-44252

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double free issue exists in the btrfs module within the create space info function error path. When kobject init and add fails, the system executes a call chain that leads to space inf...

pullkin (>=0.10.0, <=0.12.1), token-sub-info (>=0.1.16, <=0.1.20) potentially affected by CVE-2026-34073 via cryptography (40.0.0)

cryptography PYPI version 40.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - pullkin =0.10.0, =0.1.16, =0.1.20 Source cves: CVE-2026-34073 Source advisory: OSV:PYSEC-2026-35...

CVE-2025-66037

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzzpkcs15reader harness causes OpenSC to perform an out-of-bounds heap read in the X.509/SPKI handling path. Specifically, scpkcs15pubkeyfromspkifields allocates a zero-length buffer...

CVE-2025-66037

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzzpkcs15reader harness causes OpenSC to perform an out-of-bounds heap read in the X.509/SPKI handling path. Specifically, scpkcs15pubkeyfromspkifields allocates a zero-length buffer...

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

Summary The nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. Details The backup format lacks a trusted integrity root. Although files are encrypted, the encryption key and IV are provided to the clie...

sound/soc/mediatek/common/mtk-soundcard-driver parse_dai_link_info

The vulnerability of the parsedailinkinfo function in the sound/soc/mediatek/common/mtk-soundcard-driver.c file relates to the sound support for Linux operating system kernels. It involves errors during link counter updates. Exploiting this vulnerability could allow an attacker to cause service...

PT-2026-36452

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An information leak occurs in the Linux kernel when building netlink messages. The tc chain fill node function fails to initialize the tcm info field of the struct tcmsg structure. Becau...

Linux Distros Unpatched Vulnerability : CVE-2026-33487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the validateSignature function in validate.go goes through the references in...

pullkin (>=0.10.0, <=0.12.1), token-sub-info (>=0.1.16, <=0.1.20) potentially affected by CVE-2026-34073 via cryptography (40.0.0)

cryptography PYPI version 40.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - pullkin =0.10.0, =0.1.16, =0.1.20 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

CVE-2026-33044 Home Assistant has stored XSS in Map-card through malicious device name

Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see ...

BIT-NATS-2026-33246 NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a Nats-Request-Info: message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NAT...