1156 matches found
EUVD-2026-46389
Incorrect Authorization CWE-863 in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices'...
CVE-2026-47237
Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the...
CVE-2026-12590 vulnerabilities
Vulnerabilities for packages: argo-workflows, tileserver-gl, kubeflow-pipelines, code-server, sqlpad, langfuse, json-server, kubeflow-centraldashboard...
GHSA-V422-HMWV-36X6 vulnerabilities
Vulnerabilities for packages: argo-workflows, tileserver-gl, kubeflow-pipelines, code-server, sqlpad, langfuse, json-server, kubeflow-centraldashboard...
CVE-2026-56144
Incorrect Authorization CWE-863 in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices'...
CVE-2026-56144
Technical details about CVE-2026-56144 are not publicly provided in the supplied documents; no affected products, versions, or fixes are specified here. Monitor for updates in connected sources.
CVE-2026-56144
Incorrect Authorization CWE-863 in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices'...
CVE-2026-56144 Incorrect Authorization in Elasticsearch Leading to Information Disclosure
Incorrect Authorization CWE-863 in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices'...
PT-2026-62092
Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Insufficient authorization controls in the ingest simulation feature allow an authenticated user with limited index privileges to target indices they are not authorized to access...
GHSA-29GW-9793-FVW7 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
CVE-2023-24816 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
CVE-2025-9906 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
GHSA-36FQ-JGMW-4R9C vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
GHSA-29GW-9793-FVW7 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
GHSA-36FQ-JGMW-4R9C vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
CVE-2025-9906 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
CVE-2023-24816 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
CVE-2026-45804
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.frompretrained flow can bypass the trustremotecode guard because download validates modelindex.json and custom pipeline code before later loading from a cached folder that can change, allowin...
PYSEC-2026-2661 MLflow has a command injection in mlflow/sagemaker/__init__.py
A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the mlflow/sagemaker/init.py file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, whic...
PYSEC-2026-1721 open-webui allows writing and deleting arbitrary files
In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHEDIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote cod...