CVE-2026-61778

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability (CVE-2026-61778). An attacker with local access and low privileges, requiring no user interaction, could trigger the deserialization flaw, potentially leading to code execution, data tampering, and information...

CVE-2026-61779

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability that could allow an attacker to achieve code execution , data tampering , and information disclosure . The CVSS 3.1 score is 7.8 (HIGH) , with a local attack vector , low complexity , and low privileges requir...

CVE-2026-61770

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A local attacker with low privileges (no user interaction required) could exploit this to achieve code execution, data tampering, and information disclosure , with high impact on confidentiality, integrity, a...

CVE-2026-61771

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability (CVE-2026-61771). A successful exploit could lead to code execution, data tampering, and information disclosure . The CVSS v3.1 score is 7.8 (HIGH) with a local attack vector, low privileges required, and no u...

CVE-2026-61772

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability that could allow an attacker with local access and low privileges to achieve code execution, data tampering, and information disclosure . The assigned CVSS 3.1 score is 7.8 (HIGH) , with a local attack vector,...

CVE-2026-61773

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could lead to code execution, data tampering, and information disclosure . The assigned CVSS v3.1 score is 7.8 (HIGH) with a local attack vector , low complexity, and low privileges requi...

CVE-2026-61774

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could lead to code execution , data tampering , and information disclosure . The CVSS v3.1 score is 7.8 (HIGH) , with a local attack vector, low privileges required, and no user interacti...

CVE-2026-61775

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could lead to code execution, data tampering, and information disclosure . The CVSS v3.1 base score is 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, ...

CVE-2026-61776

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could result in code execution, data tampering, and information disclosure . The assigned CVSS 3.1 score is 7.8 (HIGH) , with a local attack vector , low complexity , low privileges requi...

CVE-2026-61766

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could lead to code execution , data tampering , and information disclosure . The assigned CVSS 3.1 score is 7.8 (HIGH) with a local attack vector, low complexity, and low privileges requi...

CVE-2026-61767

NVIDIA Megatron Bridge is vulnerable to deserialization of untrusted data , which could allow an attacker to achieve code execution, data tampering, and information disclosure . The vulnerability has a CVSS 3.1 base score of 7.8 (HIGH) with a local attack vector, low complexity, low privileges re...

CVE-2026-61768

NVIDIA Megatron Bridge is affected by a vulnerability where an attacker could cause deserialization of untrusted data . A successful exploit may lead to code execution, data tampering, and information disclosure . The CVSS 3.1 base score is 7.8 (HIGH) , with a local attack vector, low complexity,...

CVE-2026-61760

CVE-2026-61760 is a deserialization of untrusted data vulnerability (CWE-502) in NVIDIA Megatron Bridge , affecting versions 0.0 through 0.5.0 on all platforms. A successful local exploit with low privileges required could result in code execution, data tampering, and information disclosure , wit...

CVE-2026-61761

CVE-2026-61761 is one of 30 deserialization-of-untrusted-data flaws (CWE-502) in NVIDIA Megatron Bridge , an open-source framework for large-scale model training. The vulnerability requires local access with low privileges and no user interaction , yet can lead to code execution, data tampering, ...

CVE-2026-61762

NVIDIA Megatron Bridge (versions 0.0 to 0.5.0) is vulnerable to deserialization of untrusted data (CWE-502). An attacker with local access and low privileges can exploit this to achieve code execution, data tampering, and information disclosure , rated CVSS 7.8 (HIGH) . The vulnerability affects ...

CVE-2026-61763

NVIDIA Megatron Bridge versions 0.0 through 0.5.0 are affected by a deserialization of untrusted data vulnerability (CWE-502). A local attacker with low privileges can exploit this without user interaction to achieve code execution, data tampering, and information disclosure , rated CVSS 7.8 (HIG...

CVE-2026-61764

CVE-2026-61764 is a deserialization of untrusted data vulnerability (CWE-502 ) in NVIDIA Megatron Bridge , affecting versions 0.0 through 0.5.0 on all platforms. A successful local exploit (low complexity, low privileges required) could lead to code execution, data tampering, and information disc...

CVE-2026-61765

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. An attacker with local access and low privileges (no user interaction required) could exploit this to achieve code execution , data tampering , and information disclosure . The vulnerability carries a CVSS 3....

CVE-2026-61759

NVIDIA Megatron Bridge versions 0.0 through 0.5.0 (all platforms) are affected by a deserialization of untrusted data flaw (CWE-502). A local attacker with low privileges can exploit it to achieve code execution, data tampering, and information disclosure , rated CVSS 7.8 (HIGH) . This is one of ...

CVE-2026-61750

NVIDIA Megatron Bridge is vulnerable to deserialization of untrusted data (CWE-502) . An attacker with local access and low privileges (no user interaction required) can trigger the flaw, potentially leading to code execution, data tampering, and information disclosure . The CVSS v3.1 base score ...

CVE-2026-61751

CVE-2026-61751 affects NVIDIA Megatron Bridge (versions 0.0 through 0.5.0, all platforms). The root cause is deserialization of untrusted data (CWE-502), which a local attacker with low privileges and no user interaction can exploit to achieve code execution, data tampering, and information discl...

CVE-2026-61752

NVIDIA Megatron Bridge (versions 0.0 to 0.5.0) is affected by a deserialization of untrusted data vulnerability (CWE-502). A local attacker with low privileges and no user interaction could exploit this to achieve code execution, data tampering, and information disclosure , rated CVSS 7.8 (HIGH) ...

CVE-2026-61753

NVIDIA Megatron Bridge is affected by a vulnerability allowing an attacker to cause deserialization of untrusted data , which could lead to code execution, data tampering, and information disclosure . The connected NVIDIA security bulletin classifies this specific CVE under CWE-22 (Path Traversal...

CVE-2026-61754

CVE-2026-61754 affects NVIDIA Megatron Bridge (versions 0.0 through 0.5.0 , all platforms). The root cause is deserialization of untrusted data (CWE-502), allowing a local attacker with low privileges to achieve code execution, data tampering, and information disclosure . The CVSS v3.1 score is 7...

CVE-2026-61758

CVE-2026-61758 affects NVIDIA Megatron Bridge (versions 0.0 to 0.5.0 , all platforms). The root cause is deserialization of untrusted data (CWE-502), allowing a local attacker with low privileges to achieve code execution, data tampering, and information disclosure . The vulnerability is scored C...

CVE-2026-61755

CVE-2026-61755 affects NVIDIA Megatron Bridge versions 0.0 through 0.5.0 across all platforms. The root cause is a deserialization of untrusted data flaw (CWE-502), part of a batch of 30 related CVEs disclosed in NVIDIA's September 2026 security bulletin. A successful local exploit requires low p...

CVE-2026-61756

NVIDIA Megatron Bridge (versions 0.0 to 0.5.0) is affected by a deserialization of untrusted data vulnerability (CWE-502). A local attacker with low privileges and no user interaction can exploit this to achieve code execution, data tampering, and information disclosure . The CVSS 3.1 score is 7....

CVE-2026-61757

NVIDIA Megatron Bridge versions 0.0 through 0.5.0 contain a deserialization of untrusted data vulnerability (CWE-502) rated HIGH (CVSS 7.8) . A local attacker with low privileges and no user interaction could exploit this to achieve code execution, data tampering, and information disclosure . The...

CVE-2026-79687

Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability (CVE-2026-79687). An unauthenticated attacker with remote network access could exploit the flaw to obtain filesystem access , with a changed scope and High impact on confidentiality, integrity, and availab...

CVE-2026-58567

Dell PowerStore is affected by an OS Command Injection vulnerability that allows an authenticated user with limited privileges to execute arbitrary commands with root privileges . The CVSS 3.1 score is 8.8 (HIGH) , with a local attack vector, low complexity, low privileges required, changed scope...

CVE-2026-49329

A flaw in openshift/oauth-server allows an unauthenticated attacker to trigger a quadratic-time denial of service by sending a crafted Accept-Language header using '_' separators to the OAuth login and error page endpoints. The root cause is a bypass of the CVE-2022-32149 mitigation : the upstrea...

CVE-2026-10195

FS-Poster WordPress plugin (versions up to and including 8.0.1 ) is vulnerable to authenticated remote code execution via insufficient sanitization of the FFmpeg path parameter before it is passed to the exec() function, combined with missing authorization checks on REST API endpoints. Attackers ...

CVE-2026-79682

Dell PowerStore is affected by a Command Injection vulnerability that allows an authenticated user with limited privileges to execute arbitrary commands with root privileges . The CVSS 3.1 score is 8.8 (HIGH) with a local attack vector, low complexity, and changed scope, resulting in high impact ...

CVE-2026-84270

The affected software is gvfs (GNOME Virtual Filesystem), specifically its MTP backend . The flaw resides in do_read() within gvfsbackendmtp.c , which trusts the data length returned by a connected MTP device without capping it to the size originally requested by the client. When a malicious devi...

CVE-2026-84269

A heap-based buffer overflow was identified in the AFP backend of gvfs . When mounting a share, a malicious AFP server can supply a length in the DSI read path that exceeds the size the client requested. Because the function does not validate the server-provided length against the pre-sized reply...

CVE-2026-84267

CVE-2026-84267 is an uninitialized heap memory disclosure in the SFTP backend of gvfs (GNOME Virtual File System). The root cause is in the read_string() function, which allocates a buffer without verifying it is fully populated. A malicious SFTP server can send a short FXP_HANDLE reply, causing ...

CVE-2026-84207

Heym before 0.0.98 is affected by a Server-Side Request Forgery (SSRF) vulnerability in its WebSocket Send and WebSocket Trigger workflow nodes. The root cause is the failure to apply SSRF egress guards to these nodes, allowing authenticated users to craft workflow nodes with arbitrary URLs and h...

CVE-2026-84206

Snipe-IT before 8.7.0 contains an authorization bypass in the bulk asset restore endpoint , which is gated on the assets.edit permission instead of the intended assets.delete permission. This allows authenticated users with only edit rights to restore soft-deleted assets by posting asset identifi...

CVE-2026-84232

CVE-2026-84232 is a stored cross-site scripting (XSS) vulnerability in pulpcore's content serving application (python-pulpcore). The root cause is that files uploaded to Pulp file-type repositories are served with their original MIME type (e.g., text/html, image/svg+xml) and without a Content-Dis...

CVE-2026-84205

GROWI through 8.0.2 contains an authorization bypass in the GET /_api/v3/revisions/:id endpoint. The vulnerability arises because the endpoint validates access using a query parameter but returns the revision identified by the path parameter without confirming both reference the same page. An aut...

CVE-2026-84204

GROWI through 8.0.2 contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they are not authorized to view by supplying known attachment identifiers. T...

CVE-2026-84203

Memos versions 0.26.0 through 0.30.0 contain an insufficient session expiration flaw: refresh tokens are not revoked when a user changes their password. An attacker holding a stolen refresh token can call the RefreshToken RPC to mint new access tokens and rotate the refresh token indefinitely, ef...

CVE-2026-84202

ModelScope (through v1.40.0 ) uses PyYAML's unsafe yaml.Loader to parse model configuration files, enabling arbitrary code execution via Python object construction tags. An attacker can craft a malicious model repository with a poisoned configuration file that executes code when a user loads the ...

CVE-2026-84201

appium-mcp-server through 0.1.61 is affected by a path traversal vulnerability in the write_file and write_files_batch tools. The server fails to validate or normalize file paths, allowing an attacker to supply absolute paths or relative paths with parent-directory segments to write files outside...

CVE-2026-84268

CVE-2026-84268 is a heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp process). When mounting a share and reading a file, the read_reply() function fails to validate the server-provided length against the allocated buffer size, allowing a malicious SFTP server to write past intended...

CVE-2026-84153

Xinhu Rainrock RockOA versions up to 2.3.2 contain a SQL injection vulnerability in the toaddval function of /index.php?m=index&a=publicsavevalue&ajaxbool=true. Manipulating the Value parameter allows a remote attacker with low privileges to affect confidentiality, integrity, and availability (CV...

CVE-2026-18931

This CVSS 9.1 (Critical) vulnerability affects TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software , versions V.4 through before V.16 . The root cause is hard-coded credentials embedded in the software, which allow an unauthenticated network attacker to retrieve embed...

CVE-2026-18630

CVE-2026-18630 is a SQL injection vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software , affecting versions from V.4 up to but not including V.16 . The root cause is improper neutralization of special elements used in an SQL command. The CVSS 3.1 score...

CVE-2026-18780

TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software contains a Cross-Site Request Forgery (CSRF) vulnerability affecting versions V.4 through before V.16 . The vulnerability allows an attacker to forge requests on behalf of an authenticated user, resulting in a High i...

CVE-2026-78012

A stack-based buffer overflow in Pyramid Solutions NetStaX EtherNet/IP Stack prior to v5.6.1 allows a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning to the originating device. The result can be memory corruption , a devi...