MINI-Q2PR-9CM6-VV7C

Bulletin has no description...

MINI-92Q7-JG57-CW7J

Bulletin has no description...

MINI-935X-8537-9VJQ

Bulletin has no description...

MINI-5FQR-MX3J-MC87

Bulletin has no description...

CVE-2026-92701 Cocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path

Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS aTLS Intel TDX verification path does not copy the expected current-session freshness value into the TDX quote-body...

MINI-MQHC-WH66-F5X4

Bulletin has no description...

MINI-5WG6-W8VV-HPVR

Bulletin has no description...

MINI-RF35-FXWC-9GR9

Bulletin has no description...

MINI-H8QW-QHFC-PHF5

Bulletin has no description...

MINI-JH8J-FQ5F-HMF4

Bulletin has no description...

CVE-2026-64847 AnyIO process-pool workers can block indefinitely on undrained stderr

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...

GHSA-3HMM-RH5Q-GWWR LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

Summary lmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with...

GHSA-2VH9-42VM-XMV2 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

Summary LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recvpyobj to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements recvpyobj using Python pickle deserialization, which can execute arbitrary code while reconstructing an object. The peer address used...

CVE-2025-66455 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recvpyobj to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements...

MINI-FGV2-XQGV-233G

Bulletin has no description...

CVE-2026-92702 Cocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path

Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS aTLS AMD SEV-SNP verification path does not enforce attestation freshness when the expected reportData value is nil,...

MINI-56P5-9X73-F88G

Bulletin has no description...

MINI-V3M5-3C3Q-8CQJ

Bulletin has no description...

MINI-832M-JQPJ-4VWJ

Bulletin has no description...

CVE-2026-63349 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess and anyio.openprocess, but openprocess forwards the group argument to the backend instead of extragroups...

MINI-664M-GJ79-WVJ7

Bulletin has no description...

MINI-HMXX-RHV5-HX44

Bulletin has no description...

MINI-FX76-3MGG-PWRQ

Bulletin has no description...

MINI-5VM9-XW28-F3Q6

Bulletin has no description...

MINI-8PHV-4RP9-XR4H

Bulletin has no description...

MINI-X4XH-2M9P-69RH

Bulletin has no description...

MINI-WXP5-HVPP-R4RW

Bulletin has no description...

MINI-5V8V-76G4-HQ4X

Bulletin has no description...

MINI-J228-C95R-XQRW

Bulletin has no description...

MINI-MCJC-3RFH-7GRH

Bulletin has no description...

MINI-PP8Q-3J73-Q68M

Bulletin has no description...

MINI-XX6R-FXQP-4FQH

Bulletin has no description...

MINI-7J7W-9MXX-WVM3

Bulletin has no description...

MINI-X8CF-QVQH-56R9

Bulletin has no description...

MINI-59Q3-F658-FFFQ

Bulletin has no description...

MINI-5F63-68WM-WG95

Bulletin has no description...

MINI-78J6-VGQM-QJ8R

Bulletin has no description...

GHSA-JR78-W6W5-M8F8 Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks

Summary The api.php?action=smwtask API module performs no authorization check. The equivalent maintenance interface in the web UI Special:SMWAdmin requires the smw-admin right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can therefore...

MINI-G4MH-56RQ-58R5

Bulletin has no description...

GHSA-9RCC-PMJ8-FFHR Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

Summary Special:FacetedSearch cstate hidden inputs enable reflected XSS residual of CVE-2025-10354 Details Affected versions and vulnerable location - Confirmed present on latest shipped release tag available in the local clone: SemanticMediaWiki/[email protected]. - Confirmed present on...

GHSA-CX86-7XWP-W9WF Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

Reflected XSS via a forged cursor pagination token Failure mode Special:Ask accepts a cursor query parameter for keyset pagination added in 7.0.0. The token is decoded by CursorEncoder, which is an unsigned base64url-encoded JSON blob, so its contents are fully attacker-controlled. When the...

CVE-2026-77616 Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. In versions 7.0.0 through 7.1.0, Special:Ask accepts a cursor query parameter for keyset pagination added in 7.0.0. The token is decoded by CursorEncoder, which is an...

CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...

CVE-2026-77610 Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, query debug output format=debug, or the debug request parameter on Special:Ask is assembled by SMW\Query\DebugFormatter and emitted as raw HTML...

CVE-2026-61548 Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data

Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSDPARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal32 1024 stack buffer and calls parsePARAMVALUE without supplying the...

CVE-2026-55556 Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parseauthheader function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc0, len when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes...

GHSA-Q5FM-9MX6-44F4 Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

Query debug output XSS Failure mode Semantic MediaWiki's query debug output format=debug, or the debug request parameter on Special:Ask is assembled by SMW\Query\DebugFormatter and emitted as raw HTML. Several of its sinks apply no output-context encoding, so attacker-controlled query input is...

CVE-2026-77609 Semantic MediaWiki has an open redirect in Special:URIResolver

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, Special:URIResolver resolves its user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to $title-getFullURL without...

CVE-2026-63406 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and...

GHSA-HW3M-8J5X-94FF Semantic MediaWiki has an open redirect in Special:URIResolver

Failure mode Special:URIResolver resolves its user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to $title-getFullURL without validating the resolved target. A crafted subpage can make that target point off-host: an interwiki prefix redirects to the foreign wiki for...