CVE-2026-85702 ramon-victor freegpt-webui Backend Conversation API backend.py _conversation missing authentication

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing...

CVE-2026-85702 ramon-victor freegpt-webui Backend Conversation API backend.py _conversation missing authentication

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing...

EUVD-2026-71750

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing...

CVE-2026-85702

A missing authentication vulnerability exists in the _conversation function of server/backend.py (Backend Conversation API) in ramon-victor freegpt-webui , affecting commits up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Remote attackers can manipulate the model argument to bypass authentication...

How to secure edge AI in customer-owned environments

In this article 1. Edge AI changes the trust model for AI systems 2. Constrain model actions through deterministic mediation 3. Establish trust before releasing sensitive assets 4. Verify runtime before releasing sensitive assets 5. Verify artifacts that shape model behavior 6. Next steps Edge AI...

How to secure edge AI in customer-owned environments

In this article 1. Edge AI changes the trust model for AI systems 2. Constrain model actions through deterministic mediation 3. Establish trust before releasing sensitive assets 4. Verify runtime before releasing sensitive assets 5. Verify artifacts that shape model behavior 6. Next steps Edge AI...

CVE-2026-85654

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute...

NPM: CodeWhale: js_execution leaks parent environment to model context via missing env scrub

NPM: CodeWhale: jsexecution leaks parent environment to model context via missing env scrub vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...

CVE-2026-85654 Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute...

CVE-2026-85654 Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute...

EUVD-2026-71635

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute...

Security Bulletin: Watson Machine Learning on Cloud Pak for Data is affected by transformers(Publicly disclosed vulnerability) ( CVE-2024-11393, CVE-2024-11394, CVE-2024-11392, CVE-2024-12720, CVE-2024-3568)

Summary Watson Machine Learning on Cloud Pak for Data is affected by CVE-2024-11393, CVE-2024-11394, CVE-2024-11392, CVE-2024-12720, CVE-2024-3568 Vulnerability Details CVEID:CVE-2024-11393 DESCRIPTION: Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code...

CVE-2026-85695 FastChat Unauthenticated Worker Registration SSRF and Model Spoofing

FastChat contains an authentication bypass vulnerability in the /registerworker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompt...

CVE-2026-85695 FastChat Unauthenticated Worker Registration SSRF and Model Spoofing

FastChat contains an authentication bypass vulnerability in the /registerworker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompt...

CVE-2026-85695

FastChat (lm-sys/FastChat) has an authentication bypass in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses. This enables server-side request forgery (SSRF) and model spoofing : attackers can register malicious workers under victim model n...

CVE-2026-85695 FastChat Unauthenticated Worker Registration SSRF and Model Spoofing

FastChat contains an authentication bypass vulnerability in the /registerworker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompt...

CVE-2026-85690

Plandex 2.2.1 is vulnerable to a path traversal in the ApplyFiles function, which allows files to be written outside the project directory. Attackers can influence model output through poisoned repository files or attacker-controlled context to write to sensitive locations such as shell rc or cro...

CVE-2026-85668

Xinference (v3.x, affected commit 4a94832, specifically v3.3.0) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint. The endpoint accepts a caller-supplied model_path parameter without authentication or path confinement, reads and p...

Cache Poisoning

Spring AI is vulnerable to cache poisoning. The vulnerability is due to insecure handling of the deterministic cache path, where an attacker can pre‑create the cache directory and plant a malicious ONNX model file and achieve execution when the model is loaded...

PT-2026-86228

Name of the Vulnerable Software and Affected Versions PassMark PerformanceTest versions prior to 11.1 build 1012 BurnInTest versions prior to 11.1 build 1000 OSForensics versions prior to 11.1 build 1016 Description A privilege escalation and denial-of-service issue exists in the DirectIo64.sys...