aiopath (0.6.6), nectarifere (>=2.0.1, <=2.4.0) +1 more potentially affected by CVE-2026-63374 via anyio (3.0.1)

anyio PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aiopath 0.6.6 - nectarifere =2.0.1, =0.5.0, =0.6.0 Source cves: CVE-2026-63374 Source advisory: OSV:PYSEC-2026-4025...

aiopath (0.6.6), nectarifere (>=2.0.1, <=2.4.0) +1 more potentially affected by CVE-2026-64847 via anyio (3.0.1)

anyio PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aiopath 0.6.6 - nectarifere =2.0.1, =0.5.0, =0.6.0 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

aiopath (0.6.6), nectarifere (>=2.0.1, <=2.4.0) +1 more potentially affected by CVE-2026-63374 via anyio (3.0.1)

anyio PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aiopath 0.6.6 - nectarifere =2.0.1, =0.5.0, =0.6.0 Source cves: CVE-2026-63374 Source advisory: OSV:GHSA-82R6-8W77-94W6...

aiopath (0.6.6), nectarifere (>=2.0.1, <=2.4.0) +1 more potentially affected by CVE-2026-64847 via anyio (3.0.1)

anyio PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aiopath 0.6.6 - nectarifere =2.0.1, =0.5.0, =0.6.0 Source cves: CVE-2026-64847 Source advisory: OSV:GHSA-5P39-CFHJ-2XMP...

PYSEC-2026-3916 reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

reachy_mini Allows Unrestricted Upload of File with Dangerous Type

SummaryThe Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full Ro...

GHSA-M2PC-3Q4Q-W6JR reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

PT-2026-82001

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

CVE-2026-56845

An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...

CVE-2026-56845

An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...

EUVD-2026-52560

An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...

CVE-2026-56845

The CVE describes an unauthenticated Local File Inclusion (LFI) vulnerability under /custom-sounds/ when CustomSounds storage uses FileSystem. An attacker can use ../ sequences in the request path to read arbitrary files outside the base directory. Documented impact is reading sensitive files; no...

CVE-2026-56845

An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...

CVE-2026-56845

An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...

PT-2026-67573

An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...

Transforming Keystroke Noise to Text: Self-Supervised Acoustic Eavesdropping Attacks on Keyboards

We present a self-supervised acoustic eavesdropping attack that reconstructs typed text solely from keystroke sounds, without requiring labeled data for the target device. The proposed attack enables stealthy eavesdropping in two real-world scenarios-physical spaces public and semi-public and...

Natural Backdoor Attacks on Speech Recognition Models

With the rapid development of deep learning, its vulnerability has gradually emerged in recent years. This work focuses on backdoor attacks on speech recognition systems. We adopt sounds that are ordinary in nature or in our daily life as triggers for natural backdoor attacks. We conduct...

com.mtvi.plateng.hudson:ldapemail (0.8), org.jenkins-ci.main:jenkins-test-harness (1.436) +7 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.436)

org.jenkins-ci.main:jenkins-core MAVEN version 1.436 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.mtvi.plateng.hudson:ldapemail 0.8 - org.jenkins-ci.main:jenkins-test-harness 1.436 -...

com.mtvi.plateng.hudson:ldapemail (0.8), org.jenkins-ci.main:jenkins-test-harness (1.436) +7 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (1.436)

org.jenkins-ci.main:jenkins-core MAVEN version 1.436 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.mtvi.plateng.hudson:ldapemail 0.8 - org.jenkins-ci.main:jenkins-test-harness 1.436 -...