490235 matches found
CVE-2026-69148 MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a runid or modelid after validatesourcerun or validatesourcemodel in mlflow/server/handlers.py verifies only path containment, allowing...
CVE-2026-69148 MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a runid or modelid after validatesourcerun or validatesourcemodel in mlflow/server/handlers.py verifies only path containment, allowing...
CVE-2026-69148 MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a runid or modelid after validatesourcerun or validatesourcemodel in mlflow/server/handlers.py verifies only path containment, allowing...
EUVD-2026-60474
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a runid or modelid after validatesourcerun or validatesourcemodel in mlflow/server/handlers.py verifies only path containment, allowing...
CVE-2026-69148
In MLflow versions prior to 3.15.0, the CreateModelVersion handler in mlflow/server/handlers.py validates only path containment via _validate_source_run() or _validate_source_model(), omitting READ permission checks. An authenticated user can reference another user's artifact directory and read f...
CVE-2026-75483
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directori...
CVE-2026-64849
MLflow versions before 3.15.0 expose an unauthenticated full-read SSRF: _validate_webhook_url() in mlflow/utils/validation.py validates only the original URL while mlflow/webhooks/delivery.py follows HTTP redirects without IP pinning, letting attackers reach internal/cloud-metadata endpoints. CIR...
EUVD-2026-60467
JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath...
EUVD-2026-60457
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval,...
CVE-2026-54356 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled...
CVE-2026-73410
Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resol...
CVE-2026-64657 Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...
MINI-2VGX-723Q-3JRC
Bulletin has no description...
MINI-7WRF-9R4P-3W4W
Bulletin has no description...
MINI-6MR8-3RW9-32XX
Bulletin has no description...
MINI-VXW9-3W96-7945
Bulletin has no description...
MINI-3XPQ-2VQ7-PGFP
Bulletin has no description...
MINI-JJ69-H6XW-VP7W
Bulletin has no description...