CVE-2025-57622

The image-to-video model Step-Video-T2V contains a critical security vulnerability allowing for remote code execution (RCE) . The root cause is the insecure deserialization of untrusted data using the pickle.loads(request.get_data()) component within the /vae-api and /caption-api endpoints. A rem...

CVE-2025-57622

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loadsrequest.getdata component...

CVE-2025-57622: Deserialization of Untrusted Data

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loadsrequest.getdata component...

CVE-2025-47383

CVE-2025-47383 describes a weak configuration that may cause a cryptographic issue when a VoWiFi call is triggered from UE. Connected records repeat the description and list a CVSS v3.1 base score of 7.2 (HIGH) with NETWORK attack vector, low attack complexity, and high impact on confidentiality,...

CVE-2025-47383 Missing Cryptographic Step in Data Modem

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE...

Missing Critical Step in Authentication

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Critical Step in Authentication due to insufficient validation of the authentication Level of Assuran...

TraceGuard: Process-Guided Firewall against Reasoning Backdoors in Large Language Models

The deployment of Large Reasoning Models LRMs in high-stakes decision-making pipelines has introduced a novel and opaque attack surface: reasoning backdoors. In these attacks, the model's intermediate Chain-of-Thought CoT is manipulated to provide a linguistically plausible but logically fallacio...

PT-2026-21901

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description A time-of-create-to-time-of-use TOCTOU issue allows re-deletion of recently deleted and recreated data sources without authorization. The attack requires specific conditions: admin access to...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: temporal-server, seaweedfs, rekor, temporal, nri-mysql, kyverno-fips, kyverno-policy-reporter-fips, sops-fips, trillian-fips, tkn, dex-fips, step-kms-plugin, hydra, percona-xtradb-cluster-operator, beats-fips, certificate-transparency, spicedb-fips,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: db-operator, mariadb-operator, k3s, step-kms-plugin, juicefs, tailscale, rekor, kyverno-policy-reporter, nri-mysql, cerbos, ratify, trufflehog, tkn, openbao, chezmoi, crossplane-provider-sql, fulcio, dgraph, age, argo-workflows, apko, dex, timestamp-authority, sftpgo...

Path Traversal in NLTK Downloader Package Metadata Allows Arbitrary File Write

Description The NLTK downloader does not validate file paths constructed from package metadata before writing downloaded files. A malicious NLTK data server can specify arbitrary paths via the subdir and id attributes in the package index XML, allowing arbitrary file write outside the intended...

Missing Cryptographic Step

Overview org.webjars.npm:jsrsasign is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by...

Missing Cryptographic Step

Overview jsrsasign is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be...

12 Step Meeting List < 3.16.6 - Unauthenticated Sensitive Information Exposure

The 12 Step Meeting List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.5.This makes it possible for unauthenticated attackers to extract sensitive user or configuration data via two AJAX endpoints: tsmlinfo and tsmlgeocodes. id:...

CVE-2026-1537

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the loadstep function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to vie...

CVE-2026-1537

CVE-2026-1537 pertains to the WordPress plugin LatePoint – Calendar Booking Plugin for Appointments and Events. The vulnerability is an missing authorization to booking details exposure in all versions up to and including 5.2.6, enabling unauthenticated attackers to view sensitive booking data (c...

CVE-2026-1537 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the loadstep function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to vie...

CVE-2026-1537

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the loadstep function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to vie...

CVE-2026-1537 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the loadstep function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to vie...

PT-2026-7813

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load step function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to vi...