CVE-2026-65920

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920

Diffusers up to 0.39.0 is affected by a path traversal in the _get_checkpoint_shard_files function. Attackers can supply malicious weight_map values in the model index JSON (e.g., ../ sequences or absolute paths) to escape the model directory and read safetensors files outside the intended locati...

CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65699

AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target runid in the request body without ownership verification. The AgentCRUD.createtask and...

MINI-MWH8-24W6-RM59

Bulletin has no description...

MINI-4MPV-646Q-CCWF

Bulletin has no description...

MINI-544P-FF8G-C437

Bulletin has no description...

MINI-W38V-85HC-5F9H

Bulletin has no description...

MINI-GW5M-QM6M-59RH

Bulletin has no description...

MINI-522C-FW5G-M5X5

Bulletin has no description...

MINI-P43R-HCMR-5WWG

Bulletin has no description...

MINI-9848-XRHQ-282P

Bulletin has no description...

MINI-MPF2-388R-985H

Bulletin has no description...

MINI-H26C-HH6Q-VRHF

Bulletin has no description...

MINI-GV3C-MV33-5FWR

Bulletin has no description...

MINI-M738-2H77-F2FH

Bulletin has no description...

MINI-264F-2X6M-P57W

Bulletin has no description...

DEBIAN-CVE-2026-15037

Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...