Deserialization of Untrusted Data

Overview InvokeAI is an An implementation of Stable Diffusion which provides various new features and options to aid the image generation process Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the /api/v2/models/install API. An attacker can execute...

Debian: Security Advisory (DSA-5882-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Missing Critical Step in Authentication

Overview lollms is a python library for AI personality definition Affected versions of this package are vulnerable to Missing Critical Step in Authentication due to a missing checkaccess call in the installbinding function. An attacker can add, modify, and remove bindings by accessing the...

CVE-2024-8898

A path traversal vulnerability exists in the "install" and "uninstall" API endpoints of parisneo/lollms-webui version V12 Strawberry. This vulnerability allows attackers to create or delete directories with arbitrary paths on the system. The issue arises due to insufficient sanitization of...

CVE-2024-12029

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious cod...

PT-2025-12248

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version V12 Strawberry Description A path traversal issue exists in the API endpoints for installation and uninstallation. This allows attackers to create or delete directories with arbitrary paths on the system. The...

LoLLMs Web UI 安全漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs Web UI version V12, which stems from the install and uninstall API endpoints not being adequately cleaned of user input,...

CVE-2024-12029: Deserialization of Untrusted Data

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious cod...

CVE-2024-8898: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in the install and uninstall API endpoints of parisneo/lollms-webui version V12 Strawberry. This vulnerability allows attackers to create or delete directories with arbitrary paths on the system. The issue arises due to insufficient sanitization of...

CVE-2024-47573

An improper validation of integrity check value vulnerability CWE-354 in FortiNDR version 7.4.2 and below, version 7.2.1 and below, version 7.1.1 and below, version 7.0.6 and below may allow an authenticated attacker with at least Read/Write permission on system maintenance to install a corrupted...

Fortinet FortiClientMAC 安全漏洞

Fortinet FortiClientMAC is a U.S. fly tower Fortinet company based on macOS platform security tools. A code execution vulnerability exists in Fortinet FortiClientMAC that originates from an external control of a file name or path, which can be exploited by a local attacker to execute arbitrary co...

openSUSE Security Advisory (openSUSE-SU-2025:0090-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-4084-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

KB5054008: Servicing stack update for Windows 10: March 11, 2025

None None...

Malicious code in nyc-config (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83c7949463fd0e15f454229b42a3390cd388e5421cf90b12a13253be059b9792 Any computer that has this package install...

Citrix Cloud: Workspace App configuration is missing silent plugin install for teams or other apps

To understand reason for certainplugin install for teams or other apps is currently unavailable along workspace configuration of Daas console On trying to enable the "Updates and Plug-ins" options for MSTeam, WebEx or Zoom the options to enabled or disable the below are not showing or missing in...

EncryptHub Deploys Ransomware and Stealer via Trojanized Apps, PPI Services, and Phishing

The financially motivated threat actor known as EncryptHub has been observed orchestrating sophisticated phishing campaigns to deploy information stealers and ransomware, while also working on a new product called EncryptRAT. "EncryptHub has been observed targeting users of popular applications, ...

Linux Distros Unpatched Vulnerability : CVE-2022-49673

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm raid: fix KASAN warning in raid5adddisks There's a KASAN warning in raid5adddisk when running the LVM testsuite. The warning happens in the test...

PT-2025-9592

Name of the Vulnerable Software and Affected Versions Animation Addons for Elementor Pro versions prior to 1.7 Description The issue allows authenticated attackers with Subscriber-level access and above to install and activate arbitrary plugins due to a missing capability check on the install...

PT-2025-9621

Name of the Vulnerable Software and Affected Versions Newscrunch theme for WordPress versions up to and including 1.8.4 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the newscrunch install and activate plugin function. This allows...