Linux Distros Unpatched Vulnerability : CVE-2026-54559

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in src/lm/ngrammodeltrie.c do not adequately validate boundary...

CVE-2026-54559

A flaw was found in PocketSphinx, a small speech recognizer. Inadequate validation of boundary conditions in language model loaders and unbounded string fields in acoustic model loaders can lead to stack or heap buffer overflows and memory corruption. An attacker with write access to a directory...

EUVD-2026-78066

PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in src/lm/ngrammodeltrie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format headers, and the acoustic-model loaders in src/mdef.c and src/util/bio.c use sscanf with unbounded...

CVE-2026-76841 Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trustremotecode=True as a literal or as an unconditional default: RerankModel.gettokenizer in...

CVE-2026-76841 Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trustremotecode=True as a literal or as an unconditional default: RerankModel.gettokenizer in...

CVE-2026-76841 Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trustremotecode=True as a literal or as an unconditional default: RerankModel.gettokenizer in...

CVE-2026-54499

CVE-2026-54499 affects Stanza prior to 1.12.2, where model loading uses torch.load(..., weights_only=True) and on an attacker-controllable pickle.UnpicklingError falls back to weights_only=False, enabling arbitrary pickle code execution when loading a malicious .pt pretrain/file. The vulnerabilit...

CVE-2026-54499 Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load attempt torch.load..., weightsonly=True but fall back to torch.load...,...

CVE-2026-54499 Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load attempt torch.load..., weightsonly=True but fall back to torch.load...,...