CVE-2026-75333

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...

PT-2026-82322

Name of the Vulnerable Software and Affected Versions yx-image-recognition version 1.0 Description The software is subject to Path Traversal, a condition where an attacker can access files and directories outside the intended folder. This occurs because the parameters dir and filePath are passed...

CVE-2026-75333: Improper Limitation of a Pathname to a Restricted Directory

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...

CVE-2026-75333

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...

Reverse-Lookup Service Exposed Millions of Photos of People’s Faces

The people-search tool ClarityCheck says its reverse image search service is “private and secure”—but it left a database containing more than 9 million image files exposed...

The vulnerability in the fs/ext4/extents.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the fs/ext4/extents.c component of the Linux operating system is related to incomplete recognition of the internal state. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the smack/smackfs.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the smack/smackfs.c component in the Linux operating system is related to incomplete recognition of internal conditions. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-73066

Tesseract prior to 5.5.3 is affected by a heap out-of-bounds write in LSTM Convolve via a crafted .traineddata loaded through the deserializer. The root cause is an unchecked signed integer multiplication that wraps the convolution output-channel count, undersizing the forward-pass output buffer ...

PT-2026-70224

Name of the Vulnerable Software and Affected Versions Tesseract versions prior to 5.5.3 Description A heap out-of-bounds write can occur during OCR recognition when a crafted .traineddata LSTM model component is loaded through the deserializer. This happens because an unchecked signed integer...

CVE-2026-73066: Out-of-bounds Write

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count,...

From Noise to Meaning: Meaningful Secret Sharing with Tamper Detection for Facial Recognition

Popularity of AI-based face recognition system directly demands protection of sensitive biometric data used for training. Visual secret sharing is an interesting idea, as it splits facial images into secret shares that look random and spread across many institutions. However, these shares look li...

CVE-2026-18277

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is...

CVE-2026-18277

Technical details about CVE-2026-18277 are not publicly available in the provided documents. Monitor for updates from the vendor and CVE records.

The vulnerability of the fingerprint recognition function of the 14Finger digital fingerprint collection utility allows a intruder to execute arbitrary code.

The vulnerability of the fingerprint recognition function of the 14Finger digital fingerprint collection utility is related to improper code generation. Exploiting this vulnerability could allow a remote attacker to generate arbitrary codes...

On Flock License Plate Tracking Cameras

A recent story of a writer who was mistakenly identified, tracked, and arrested using data from Flock cameras has gone viral. The New Jersey plates that were allegedly stolen from the LA dealer were 34 03 DTM , not 34 10 DTM. But when the police report was created and the plate was entered into...

The ACLU Is Arming Lawyers to Expose State Surveillance Secrets

A new toolkit for attorneys in Massachusetts targets the technologies police use—and conceal—to build criminal cases, from facial recognition to AI-written police reports...

[SECURITY] Fedora 43 Update: antlr4-project-4.13.2-14.fc43

ANTLR ANother Tool for Language Recognition is a powerful parser generator for reading, processing, executing, or translating structured text or binary files. It is widely used to build languages, tools, and frameworks. From a grammar, ANTLR generates a parser that can build and walk parse trees...

vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models

Issue Description Librosa defaults to using numpy.mean for mono downmixing tomono, while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results in: - Inconsistency between audio heard by humans e.g., through headphones/regular speakers and...

GHSA-6C4R-FMH3-7RH8 vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models

Issue Description Librosa defaults to using numpy.mean for mono downmixing tomono, while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results in: - Inconsistency between audio heard by humans e.g., through headphones/regular speakers and...

PT-2026-60896

Name of the Vulnerable Software and Affected Versions meta-ads-mcp versions prior to 1.0.115 Description An authentication bypass exists in the AuthInjectionMiddleware within the meta-ads-mcp package. The middleware only rejects requests when both auth token and pipeboard token are absent. Howeve...