Explainable AI-Driven Cyber Risk Analytics and Model Reliability Assessment for Intelligent Governance of U.S. Critical Infrastructure: An XGBoost and SHAP-Based Intrusion Detection Framework

The increasing penetrations of the critical infrastructure sector in the United States with intelligent digital technologies have greatly increased exposure to advanced cyber adversaries and operational vulnerabilities. AI-powered governance and automated decision-making systems are becoming a ke...

PT-2026-46242

An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via supplying a crafted HTTP query string...

CVE-2026-5241

A flaw was found in python-transformers. An attacker can exploit this vulnerability by providing a malicious model repository. During model initialization, the trustremotecode parameter, intended to prevent remote code execution, is overridden by untrusted configuration data. This allows the...

Docling: Unsafe Zip Extraction in EasyOCR Model Download

Impact In versions 2.91.0, The EasyOCR model download functionality extracted ZIP archives without validating member paths, enabling Zip Slip attacks. If an attacker could compromise the model download source via supply chain attack, DNS spoofing, or MITM, they could write arbitrary files to any...

GHSA-CJQG-RQ2H-2FVJ Docling: Unsafe Zip Extraction in EasyOCR Model Download

Impact In versions 2.91.0, The EasyOCR model download functionality extracted ZIP archives without validating member paths, enabling Zip Slip attacks. If an attacker could compromise the model download source via supply chain attack, DNS spoofing, or MITM, they could write arbitrary files to any...

Exploit for CVE-2026-2256

CVE-2026-...

blendedux (>=0.1.0, <=0.1.4), blendedux-lang (>=1.1.0, <=1.1.2) +15 more potentially affected by CVE-2026-48587 via django (4.1.7)

django PYPI version 4.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - blendedux =0.1.0, =1.1.0, =0.1.0, =0.5.0, =3.11.10, =1.0.0, =12.0.0, =1.3.2, =1.0.4, =32.0.1, =32.1.0 and more Source cves: CVE-2026-48587 Source...

huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the trustremotecode parameter, intended to prevent remote code execution, is...

GHSA-FGCW-684Q-JJ6R huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the trustremotecode parameter, intended to prevent remote code execution, is...

aiu-fms-testing-utils (>=0.2.1, <=0.2.2), avalan (>=1.2.16, <=1.3.10) +2 more potentially affected by CVE-2026-5241 via transformers (4.55.0)

transformers PYPI version 4.55.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aiu-fms-testing-utils =0.2.1, =1.2.16, =1.3.10 - live-translation 0.9.0 - vail-model-registry 0.1.12 Source cves: CVE-2026-5241 Source...

PYSEC-2026-2290

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the trustremotecode parameter, intended to prevent remote code execution, is...

CVE-2026-5241

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the trustremotecode parameter, intended to prevent remote code execution, is...

aiu-fms-testing-utils (>=0.2.1, <=0.2.2), avalan (>=1.2.16, <=1.3.10) +2 more potentially affected by CVE-2026-5241 via transformers (4.55.0)

transformers PYPI version 4.55.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aiu-fms-testing-utils =0.2.1, =1.2.16, =1.3.10 - live-translation 0.9.0 - vail-model-registry 0.1.12 Source cves: CVE-2026-5241 Source...

PYSEC-2026-2290

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the trustremotecode parameter, intended to prevent remote code execution, is...

CVE-2026-5241

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the trustremotecode parameter, intended to prevent remote code execution, is...

CVE-2026-5241

Technical details (affected products, versions, fixes, or exploit specifics) are not publicly available in the provided connected documents. Monitor for updates from vendors and security advisories.

EUVD-2026-34084

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the trustremotecode parameter, intended to prevent remote code execution, is...

CVE-2026-5241 Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the trustremotecode parameter, intended to prevent remote code execution, is...

CVE-2026-5241 Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the trustremotecode parameter, intended to prevent remote code execution, is...

autonomize-model-sdk (>=1.0.6, <=1.1.21), experiment-goodies (>=0.1.1, <=0.1.2) +1 more potentially affected by CVE-2026-4035 via mlflow (2.20.1)

mlflow PYPI version 2.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autonomize-model-sdk =1.0.6, =0.1.1, =0.1.2 - terratorch 0.99.8 Source cves: CVE-2026-4035 Source advisory: OSV:GHSA-G35P-PX32-WHV6...