13356 matches found
CVE-2025-65368
SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting XSS via user input and LLM output...
CVE-2025-65368
SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting XSS via user input and LLM output...
PT-2026-3014
Name of the Vulnerable Software and Affected Versions Keras versions 3.0.0 through 3.13.0 Description A flaw exists in the HDF5 weight loading component of Keras that allows for a denial of service. An attacker can provide a crafted .keras archive containing a valid model.weights.h5 file. This fi...
EUVD-2026-2708
SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting XSS via user input and LLM output...
SparkyFitness security vulnerability
SparkyFitness is a fitness and health management platform developed by CodeWithCJ. Version SparkyFitness v0.15.8.2 contains a security vulnerability, which stems from improper handling of user input and LLM outputs, potentially leading to cross-site scripting attacks...
GO-2025-4251 Ollama has missing authentication enabling attackers to perform model management operations in github.com/ollama/ollama
Ollama has missing authentication enabling attackers to perform model management operations in github.com/ollama/ollama...
Uncontrolled Recursion in NLTK StupidBackoff Language Model Allows Denial of Service
Description NLTK’s StupidBackoff language model contains an unbounded recursive call in its scoring logic. The recursion depth is directly proportional to the length of the supplied context and is not limited or validated by the library. This behavior is triggered through normal, documented API...
Community-powered security with AI: an open source framework for security research
Since its founding in 2019, GitHub Security Lab has had one primary goal: community-powered security. We believe that the best way to improve software security is by sharing knowledge and tools, and by using open source software so that everybody is empowered to audit the code and report any...
CVE-2026-21219
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...
CVE-2025-70747
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serviceName parameter of the sub65A28 function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...
MINI-W464-HRM8-XM38
Bulletin has no description...
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 140.7.0 ESR bsc1256340. MFSA 2026-03 CVE-2026-0877: Mitigation bypass in the DOM: Security component CVE-2026-0878: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebG...
SUSE CVE-2026-0877
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7...
PT-2026-2975
Ollama has missing authentication enabling attackers to perform model management operations in github.com/ollama/ollama...
Diffusion-Driven Deceptive Patches: Adversarial Manipulation and Forensic Detection in Facial Identity Verification
This work presents an end-to-end pipeline for generating, refining, and evaluating adversarial patches to compromise facial biometric systems, with applications in forensic analysis and security testing. We utilize FGSM to generate adversarial noise targeting an identity classifier and employ a...
CVE-2026-0837
A vulnerability was identified in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/formFireWall. Such manipulation of the argument GroupName leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor...
CVE-2022-50926 WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation
WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can modify the cookie's 'name' and 'roles' parameters to elevate from ordinary user to administrative privileges without authentication...
vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions
Summary Users can crash the vLLM engine serving multimodal models that use the Idefics3 vision model implementation by sending a specially crafted 1x1 pixel image. This causes a tensor dimension mismatch that results in an unhandled runtime error, leading to complete server termination. Details T...