bavisitter (>=0.0.0, <=0.1.0rc1), cosmoai (>=0.8.8, <=0.9.1.11) +1 more potentially affected by CVE-2026-35029 via litellm (0.13.0)

litellm PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - bavisitter =0.0.0, =0.8.8, =0.9.1.11 - open-interpreter 0.1.11 Source cves: CVE-2026-35029 Source advisory: OSV:PYSEC-2026-2597...

ROS-20260713-73-0024

The vulnerability of the FileLoader class in the CPython interpreter relates to the disclosure of information in the error-prone data area. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

PYSEC-2026-3299 Core dump when loading TFLite models with quantization in TensorFlow

Impact Certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling. Thus, since code was calling...

CVE-2026-59216 Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, geteventcall delivered execute:python and execute:tool Socket.IO events to a client-supplied sessionid after checking only that the session was connected, allowing authenticated users who learne...

CVE-2026-59216

Open WebUI prior to 0.10.0 is vulnerable to cross-user code execution via unvalidated Socket.IO event-caller session_id. The get_event_call path delivers execute:python and execute:tool events to a client-supplied session_id after only confirming the session is connected, enabling an attacker who...

CVE-2026-59216 Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, geteventcall delivered execute:python and execute:tool Socket.IO events to a client-supplied sessionid after checking only that the session was connected, allowing authenticated users who learne...

CVE-2026-59216 Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, geteventcall delivered execute:python and execute:tool Socket.IO events to a client-supplied sessionid after checking only that the session was connected, allowing authenticated users who learne...

CVE-2026-12116 CVE-2026-12116

A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed...

EUVD-2026-42582

A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed...

CVE-2026-12116 CVE-2026-12116

A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed...

CVE-2026-12116 CVE-2026-12116

A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed...

CVE-2026-12116

A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed...

CVE-2026-12116

The Xerte Online Toolkits e-learning authoring toolsuite contains a vulnerability allowing Remote Code Execution (RCE) . An attacker can modify the antivirus binary path in the tools server settings to point to a PHP interpreter . This configuration allows uploaded files to be executed as PHP cod...

PT-2026-56794

Name of the Vulnerable Software and Affected Versions Xerte Online Tools affected versions not specified Description A flaw in the tools server settings allows for Remote Code Execution RCE. An attacker can modify the antivirus binary path to point to a PHP interpreter, enabling the upload and...

CVE-2026-12116: Undefined Security Weakness

A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed...

Xerte Online Toolkit contains an authentication bypass that allows for RCE

Overview Two vulnerabilities have been discovered in Xerte Online Toolkits, an open-source e-learning authoring toolsuite intended for the creation of learning materials within a web browser. CVE-2026-14261 tracks the persistence of the /setup/ directory after installation, which allows an...

PT-2026-59758

Impact Certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling. Thus, since code was calling...

PT-2026-59715

Impact A malicious user can cause a denial of service by altering a SavedModel such that assertions in function.cc would be falsified and crash the Python interpreter. Patches We have patched the issue in GitHub commits dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2 and...

PT-2026-56882

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.10.0 Description Authenticated users can execute Python code or tools within another user's session. This occurs because the get event call function delivers execute:python and execute:tool Socket.IO events to a...

ROS-20260708-73-0035

The vulnerability of Redis’ Lua interpreter for database management systems involves the possibility of using memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...