CVE-2026-79721

MLflow platform (version 0.0.1 or newer ) is vulnerable to arbitrary code execution via a maliciously crafted model artifact . When an end user loads a tampered artifact into a project, it can execute attacker-controlled code on their system. The CNA-assigned CVSS 4.0 score is 8.6 (HIGH) , reflec...

EUVD-2026-74038

Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when loaded by the project...

CVE-2026-6511

CVE-2026-6511 : Lenovo Smart Connect for Windows is reported to have an improper access control vulnerability that could allow a local authenticated user to access files owned by another user on the same system. The issue is described as local, with low attack complexity and the attack requires l...

PYSEC-2026-1562 llama-index-core insecurely handles temporary files

The llama-index-core package, up to version 0.12.44, contains a vulnerability in the getcachedir function where a predictable, hardcoded directory path /tmp/llamaindex is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal...

PYSEC-2026-1651 MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

CVE-2026-35603

CVE-2026-35603 (Claude Code, Windows) : In versions prior to 2.1.75, Claude Code loaded the system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access permissions. Since ProgramData is writable by non-administrative user...

Insecure Temporary File Usage

llama-index-core is vulnerable to Insecure Temporary File Usage. The vulnerability is due to the use of a predictable hardcoded cache directory /tmp/llamaindex in getcachedir, where attackers on multi-user Linux systems can steal cached model data, poison embeddings, or exploit symlink race...

Qodo Gen 安全漏洞

Qodo Gen is a code AI aid from Qodo, Inc. in the United States. A security vulnerability exists in Qodo Gen that stems from vulnerability to a path traversal attack that could result in reading arbitrary local files on an end-user's system...

EUVD-2017-11786

Malware in sbrugna...

EUVD-2020-30112

Malware in sbrugna...

EUVD-2019-9730

Malware in sbrugna...

EUVD-2018-1319

Malware in sbrugna...

EUVD-2019-6175

Malware in sbrugna...

EUVD-2017-3431

Malware in sbrugna...

EUVD-2022-52809

Malicious code in bioql PyPI...

EUVD-2023-58789

Malicious code in bioql PyPI...

EUVD-2021-9341

Malicious code in bioql PyPI...

EUVD-2025-19030

Malicious code in bioql PyPI...

EUVD-2023-24419

Malicious code in bioql PyPI...

CVE-2025-28016

The CVE-2025-28016 entry concerns the PHPGurukul User Registration & Login and User Management System v3.3. A Reflected Cross-Site Scripting (XSS) vulnerability exists in loginsystem/edit-profile.php, allowing remote attackers to execute arbitrary JavaScript via the fname, lname, and contact para...