93 matches found
CVE-2026-116275
A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolveclassname of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attack...
EUVD-2026-109790
A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolveclassname of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attack...
CVE-2026-116275
A code injection vulnerability exists in AllenAI AllenNLP up to version 2.10.1 . The flaw is located in the Registrable Configuration Machinery component, specifically within the Registrable.resolve_class_name function in allennlp/common/registrable.py. By manipulating the Type argument, an attac...
CVE-2026-116275 AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection
A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolveclassname of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attack...
CVE-2026-116275 AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection
A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolveclassname of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attack...
CVE-2026-116275
A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolveclassname of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attack...
PT-2026-123330
A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve class name of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attac...
curl: Heap-use-after-free in libcurl's multi event machinery (curl_multi_remove_handle() from a socket callback nested under a notify callback)
Summary: The multi interface in libcurl 8.23.0 and current master has a reproducible use-after-free. Inside a CURLMOPTNOTIFYFUNCTION callback, calling curleasypause on a second transfer that is still in flight re-enters libcurl's event handling and invokes the socket callback, where a...
CVE-2026-19937 Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses
The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayablemsg.c manages a static pool of CONFIGBTMESHACCESSDELAYABLEMSGCOUNT message contexts default 4 threaded onto a freectx or busyctx list. releasedelayablemsgctx returned a context to freectx only when...
PT-2026-111112
The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable msg.c manages a static pool of CONFIG BT MESH ACCESS DELAYABLE MSG COUNT message contexts default 4 threaded onto a free ctx or busy ctx list. release delayable msg ctx returned a context to free ctx on...
CVE-2026-92085 Stored XSS in TMT Machine's Talassoft Industrial Management Software
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS. This issue affects Talassoft Industrial Management Software: before V16.0.1...
CVE-2026-92085
The Talassoft Industrial Management Software by TMT Machinery Industry and Trade Co. Ltd. contains a Stored XSS vulnerability (CWE-79) caused by improper neutralization of input during web page generation. This issue affects versions before V16.0.1 . Attackers could potentially execute malicious ...
UBUNTU-CVE-2026-74486
In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...
GO-2026-5890 Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect in github.com/kerberos-io/agent/machinery
Kerberos Hub private key X-Kerberos-Hub-PrivateKey leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect in github.com/kerberos-io/agent/machinery...
[SECURITY] Fedora 42 Update: rust-sequoia-openpgp-2.3.0-1.fc42
OpenPGP data types and associated machinery...
GHSA-XRWR-FCW6-FMQ8 Weblate: SSRF via Project-Level Machinery Configuration
Impact A user with the project.edit permission granted by the per-project "Administration" role can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflec...
PYSEC-2026-2314
Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission granted by the per-project "Administration" role can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate...
PYSEC-2026-2314
Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission granted by the per-project "Administration" role can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate...
CVE-2026-34244 Weblate: SSRF via Project-Level Machinery Configuration
Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission granted by the per-project "Administration" role can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate...
CVE-2026-34244 Weblate: SSRF via Project-Level Machinery Configuration
Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission granted by the per-project "Administration" role can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate...