CVE-2026-104908 MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging

MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user's organisation, with the default flag forced to off. However, the application stripped...

EUVD-2026-62958

In Splunk AI Toolkit versions below 6.0.0, a user who can upload models could overwrite a model being uploaded by another user by sending a concurrent upload request for the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The race condition is...

GHSA-G48V-3P35-88JR H2O Vulnerable to Arbitrary File Overwrite

In h2oai/h2o-3 version 3.46.0, the /99/Models/name/json endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the exportModelDetails function in ModelsHandler.java, where the user-controllable mexport.dir parameter is used to specify the file path for...

CVE-2023-31036

creationtimestamp| type| source ---|---|--- 2024-01-12 18:52:06+00:00| seen| https://t.me/ctinow/167437 2024-02-02 21:46:50+00:00| seen| https://t.me/ctinow/178283 2024-05-17 14:18:43+00:00| published-proof-of-concept|...