Malicious code in com.unity.ml-agents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bfceda90642153626d064813e4c0c601ca81d18a6c5fd9e96855cbdee511db13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-21459

Transient DOS while parsing per STA profile in ML IE...

CVE-2025-21459

CVE-2025-21459 affects Qualcomm WLAN components on Qualcomm-based devices. The issue is described as a transient denial-of-service that occurs while parsing per-STA (station) configuration/profile data in the ML IE/WLAN stack. Root cause details are not provided in the supplied documents beyond t...

CVE-2025-30390 Azure ML Compute Elevation of Privilege Vulnerability

...

New whitepaper outlines the taxonomy of failure modes in AI agents

We are releasing a taxonomy of failure modes in AI agents to help security professionals and machine learning engineers think through how AI systems can fail and design them with safety and security in mind. The taxonomy continues Microsoft AI Red Team's work to lead the creation of systematizati...

PYSEC-2025-32

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized...

fluoriclogppka (>=0.1.0 <=0.2.7), h2o-wave-ml (>=0.3.0 <=0.5.0) +3 more potentially affected by CVE-2024-8616 via h2o (>=3.18.0.8 <=3.44.0.3)

h2o PYPI version =3.18.0.8, =0.1.0, =0.3.0, =0.4.5, =0.0.1, =0.0.102 - tsanalysis =0.1.0 Source cves: CVE-2024-8616 Source advisory: OSV:GHSA-G48V-3P35-88JR...

amlr (>=0.3.6 <=0.4.1), arsa-ml (>=0.1.0 <=0.1.13) +29 more potentially affected by CVE-2024-7768 via h2o (>=3.18.0.8 <=3.46.0.7)

h2o PYPI version =3.18.0.8, =0.3.6, =0.1.0, =0.0.92, =1.0.81, =2019.9.10.14.39.5, =1.0.1, =0.1.20, =0.1.0, =0.1.2, =0.3.2, =0.3.0, =1.0.1.1.4, =0.4.0.dev3, =0.1.0, =3.0.1, =5.4.1 and more Source cves: CVE-2024-7768 Source advisory: OSV:GHSA-P2VC-M5FV-9W9M...

ai.h2o:sparkling-water-api-generation_2.11 (>=3.34.0.3-1-2.2 <=3.46.0.6-1-2.4), ai.h2o:sparkling-water-api-generation_2.12 (>=3.34.0.3-1-3.0 <=3.46.0.6-1-3.5) +9 more potentially affected by CVE-2024-10572 via ai.h2o:h2o-ext-xgboost (>=3.34.0.1 <=3.46.0.6)

ai.h2o:h2o-ext-xgboost MAVEN version =3.34.0.1, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.1-1-2.2, =3.34.0.1-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =2.0.0, =2.1.2 Source cves: CVE-2024-10572 Source advisory:...

fluoriclogppka (>=0.1.0 <=0.2.7), h2o-wave-ml (>=0.3.0 <=0.5.0) +1 more potentially affected by CVE-2024-10549 via h2o (>=3.32.0.2 <=3.44.0.3)

h2o PYPI version =3.32.0.2, =0.1.0, =0.3.0, =0.4.5, =0.4.15a1 Source cves: CVE-2024-10549 Source advisory: OSV:GHSA-WWR9-4GMR-XVQ9...

fluoriclogppka (>=0.1.0 <=0.2.7), h2o-wave-ml (>=0.3.0 <=0.5.0) +1 more potentially affected by CVE-2024-10550 via h2o (>=3.32.0.2 <=3.44.0.3)

h2o PYPI version =3.32.0.2, =0.1.0, =0.3.0, =0.4.5, =0.4.15a1 Source cves: CVE-2024-10550 Source advisory: OSV:GHSA-7QQ7-PVM9-X8RF...

wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one

...

CVE-2024-45569

Memory corruption while parsing the ML IE due to invalid frame content...

CVE-2024-45856

A cross-site scripting XSS vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI...

CVE-2024-33063

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present...

CVE-2024-33025

Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE...

CVE-2024-33024

Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length...

CVE-2024-33073

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE...

CVE-2024-37287

A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution...

CVE-2024-45569

Memory corruption while parsing the ML IE due to invalid frame content...