CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65699

AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target runid in the request body without ownership verification. The AgentCRUD.createtask and...

MINI-MWH8-24W6-RM59

Bulletin has no description...

MINI-4MPV-646Q-CCWF

Bulletin has no description...

MINI-544P-FF8G-C437

Bulletin has no description...

MINI-W38V-85HC-5F9H

Bulletin has no description...

MINI-GW5M-QM6M-59RH

Bulletin has no description...

MINI-522C-FW5G-M5X5

Bulletin has no description...

MINI-P43R-HCMR-5WWG

Bulletin has no description...

MINI-9848-XRHQ-282P

Bulletin has no description...

MINI-MPF2-388R-985H

Bulletin has no description...

MINI-H26C-HH6Q-VRHF

Bulletin has no description...

MINI-GV3C-MV33-5FWR

Bulletin has no description...

MINI-M738-2H77-F2FH

Bulletin has no description...

MINI-264F-2X6M-P57W

Bulletin has no description...

DEBIAN-CVE-2026-15037

Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...

EUVD-2026-48269

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

EUVD-2026-48254

Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...

PYSEC-2026-3498 PocketSphinx: Buffer overflows in language and acoustic model loading code

Impact The trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files. In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer...