Advisory ROSA-SA-2026-3295

Component: kernel-ml 5.15.208 OS: rosa-server79 Unaffected versions: = kernel-ml-5.15.208-1.0.1.res7 Affected versions: kernel-ml-5.15.208-1.0.1.res7 CVE-ID: CVE-2026-46300 BDU-ID: None CVE-Crit: Not available CVE-DESCRIPTION: A vulnerability in the XFRM ESP-in-TCP subsystem of Linux kernels. A...

FortressWAF

FortressWAF — Web Application Firewall !Licensehttps://im...

Astra Linux – Vulnerability in pygments

An infinite loop in the SMLLexer of Pygments versions 1.5 to 2.7.3 may lead to a denial of service when performing syntax highlighting of a Standard ML SML source file. This issue is observed when the input only contains the “exception” keyword...

parley-core (>=0.2.0, <=0.6.1), pqc-combo (0.1.0) +2 more potentially affected by unknown CVE via libcrux-ml-dsa (>=0.0.4, <=0.0.8)

libcrux-ml-dsa CARGO version =0.0.4, =0.2.0, =0.6.1 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-FHVH-VW7H-9XF3...

adaro-rl (0.3.0), advermorel (>=0.1.1, <=0.1.6) +17 more potentially affected by CVE-2026-31229 via adversarial-robustness-toolbox (>=0.5.0, <=1.20.1)

adversarial-robustness-toolbox PYPI version =0.5.0, =0.1.1, =0.1.0, =0.0.5, =24.6.0, =23.10.1, =1.0.1, =23.7.1, =0.2.1, =1.0.0, =0.2.0, =0.3.0, =0.4.0, =0.1.0b3, =0.1.0b6 and more Source cves: CVE-2026-31229 Source advisory: SNYK:PYTHON-ADVERSARIALROBUSTNESSTOOLBOX-17675445...

MAL-2026-3606 Malicious code in ml-toolkit-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 5e1924464368f0c5816ee84e000cc47017f44045140feafbbc9e685d847ed5a5 This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor. The package will steal credentials...

Malicious code in ml-toolkit-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 5e1924464368f0c5816ee84e000cc47017f44045140feafbbc9e685d847ed5a5 This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor. The package will steal credentials...

Malicious code in @ml-toolkit-ts/xgboost (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 5e1924464368f0c5816ee84e000cc47017f44045140feafbbc9e685d847ed5a5 This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor. The package will steal credentials...

MAL-2026-3602 Malicious code in @ml-toolkit-ts/xgboost (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 5e1924464368f0c5816ee84e000cc47017f44045140feafbbc9e685d847ed5a5 This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor. The package will steal credentials...

PT-2026-40053

The torch-checkpoint-shrink.py script in the ml-engineering project in commit 0099885db36a8f06556efe1faf552518852cb1e0 2025-20-27 contains an insecure deserialization vulnerability CWE-502. The script uses torch.load to process PyTorch checkpoint files .pt without enabling the security-restrictiv...

GHSA-MCFX-4VC6-QGXV BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context

Summary BentoML's bentoml build packaging workflow follows attacker-controlled symlinks inside the build context and copies the referenced file contents into the generated Bento artifact. If a victim builds an untrusted repository or other attacker-supplied build context, the attacker can place a...

parley-core (>=0.2.0, <=0.6.1), pqc-combo (0.1.0) +2 more potentially affected by unknown CVE via libcrux-ml-dsa (>=0.0.4, <=0.0.8)

libcrux-ml-dsa CARGO version =0.0.4, =0.2.0, =0.6.1 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0125...

FastMCP ML Workflow Server 路径遍历漏洞

FastMCP ML Workflow Server is a machine learning workflow server developed by Jinny Han. It supports drug discovery and data science applications. Version 1.0.0 of FastMCP ML Workflow Server has a path traversal vulnerability. This vulnerability stems from the incorrect handling of the parameter...

parley-core (>=0.2.0, <=0.6.1), pqc-combo (0.1.0) +2 more potentially affected by unknown CVE via libcrux-ml-dsa (>=0.0.4, <=0.0.8)

libcrux-ml-dsa CARGO version =0.0.4, =0.2.0, =0.6.1 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0126...

Keras 3.13.0 Safe Parallel ML Stress Test Generator

This script is a safe and lightweight stress-testing utility designed to simulate machine learning model generation workloads without actually allocating large memory or creating real heavy files. It was designed to test Keras 3.13.0...

CVE-2026-5194

The CVE-2026-5194 issue concerns wolfSSL’s ECDSA certificate verification: missing hash/digest size and OID checks may allow digests smaller than allowed for the given key type to pass verification when EdDSA or ML-DSA is enabled. This could reduce security of ECDSA certificate-based authenticati...

CVE-2026-5194

Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant key type, to be accepted by signature verification functions. This could lead to reduced security of ECDSA certificate-based authentication...

VulnHawk

🛡️ VulnHawk — OWASP Top 10 Web Vulnerability Scanner...

CVE-2026-33744

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the docker.systempackages field in bentofile.yaml accepts arbitrary strings that are interpolated directly into Dockerfile RUN commands without sanitization. Since...

pqc-combo (0.1.0), pqc-fips (0.0.3) +1 more potentially affected by unknown CVE via libcrux-ml-dsa (0.0.4)

libcrux-ml-dsa CARGO version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ml-dsa and may be impacted: - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-CP57-FQ8G-QH6V...