https://vulnogram.org/ Most recent CVEs assigned by Protect AI (formerly huntr.dev) (@huntr_ai). https://vulnogram.org/seaview/icons/@huntr_ai.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-12570 https://vulnogram.org/CVE-2026-12570 A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.p… Medium Mon, 10 Aug 2026 06:29:56 GMT https://vulnogram.org/CVE-2026-12372 https://vulnogram.org/CVE-2026-12372 A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to rejec… Low Network Exploitable Sun, 09 Aug 2026 22:45:52 GMT https://vulnogram.org/CVE-2026-10595 https://vulnogram.org/CVE-2026-10595 A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/routers/ui.py`. The vulnerability arises from the improper handling of user-controlled path input, which is direct… High Network Exploitable Sun, 09 Aug 2026 03:52:26 GMT https://vulnogram.org/CVE-2026-12261 https://vulnogram.org/CVE-2026-12261 A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead of package-isolated r… Medium Network Exploitable Fri, 07 Aug 2026 06:25:10 GMT https://vulnogram.org/CVE-2026-12259 https://vulnogram.org/CVE-2026-12259 In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package… Medium Network Exploitable Mon, 03 Aug 2026 07:09:35 GMT https://vulnogram.org/CVE-2026-9856 https://vulnogram.org/CVE-2026-9856 A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where ke… High Network Exploitable Sun, 02 Aug 2026 15:10:53 GMT https://vulnogram.org/CVE-2026-9335 https://vulnogram.org/CVE-2026-9335 A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group`… Medium Network Exploitable Sun, 02 Aug 2026 03:49:25 GMT https://vulnogram.org/CVE-2026-11922 https://vulnogram.org/CVE-2026-11922 A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requests by `re… Medium Network Exploitable Fri, 24 Jul 2026 03:27:39 GMT https://vulnogram.org/CVE-2026-11876 https://vulnogram.org/CVE-2026-11876 In zenml-io/zenml version 0.94.2, the `GET /api/v1/stack-deployment/stack` endpoint (`get_deployed_stack`) lacks proper RBAC authorization checks, allowing any authenticated user to enumerate all deployed stacks across all users and tenants. This inc… Medium Tue, 21 Jul 2026 14:11:19 GMT https://vulnogram.org/CVE-2026-12484 https://vulnogram.org/CVE-2026-12484 A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=Fal… High Sun, 19 Jul 2026 19:47:27 GMT https://vulnogram.org/CVE-2026-12228 https://vulnogram.org/CVE-2026-12228 A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint of parisneo/lollms (latest version). The endpoint stores attacker-controlled `prompt_content` into `DBDirectMessage.content` without server-side saniti… High Sat, 18 Jul 2026 20:36:36 GMT https://vulnogram.org/CVE-2026-12482 https://vulnogram.org/CVE-2026-12482 A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinfos` validation in `keras/src/utils/file_utils.py`. Specifically, symlink entries are not subjected to the same… Low Network Exploitable Tue, 14 Jul 2026 05:13:07 GMT https://vulnogram.org/CVE-2026-12252 https://vulnogram.org/CVE-2026-12252 In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classe… High Sat, 04 Jul 2026 00:58:58 GMT https://vulnogram.org/CVE-2026-12481 https://vulnogram.org/CVE-2026-12481 A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode… High Network Exploitable Fri, 03 Jul 2026 20:36:05 GMT https://vulnogram.org/CVE-2026-8147 https://vulnogram.org/CVE-2026-8147 In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations,… High Thu, 02 Jul 2026 07:32:58 GMT https://vulnogram.org/CVE-2026-12480 https://vulnogram.org/CVE-2026-12480 Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to check the `… Medium Wed, 01 Jul 2026 16:53:32 GMT https://vulnogram.org/CVE-2026-8387 https://vulnogram.org/CVE-2026-8387 A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting `.zip` archives using the `ZipFile.extractall()` method in `StorageManager._extract_to_cache()`. This issue arises due to the… Low Wed, 01 Jul 2026 12:26:55 GMT https://vulnogram.org/CVE-2026-6658 https://vulnogram.org/CVE-2026-6658 A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell ou… Medium Fri, 26 Jun 2026 09:40:30 GMT https://vulnogram.org/CVE-2026-12479 https://vulnogram.org/CVE-2026-12479 A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.make` method within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer n… Medium Mon, 22 Jun 2026 15:21:19 GMT https://vulnogram.org/CVE-2026-5366 https://vulnogram.org/CVE-2026-5366 Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a… Critical Sat, 20 Jun 2026 16:43:37 GMT https://vulnogram.org/CVE-2026-12199 https://vulnogram.org/CVE-2026-12199 A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in its default mode. The server listens on all interfaces and processes a specific unauthentica… High Network Exploitable Wed, 17 Jun 2026 07:13:14 GMT https://vulnogram.org/CVE-2026-3840 https://vulnogram.org/CVE-2026-3840 A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version string. The `_get_versioned_path()` method in `kedro/io/core.py` directly interpolates user-supplied version strings into filesystem pa… High Fri, 12 Jun 2026 15:45:39 GMT https://vulnogram.org/CVE-2026-11816 https://vulnogram.org/CVE-2026-11816 Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths… High Network Exploitable Thu, 11 Jun 2026 13:31:52 GMT https://vulnogram.org/CVE-2026-5497 https://vulnogram.org/CVE-2026-5497 vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processing `video/jpeg` data URLs, the method splits the ba… High Network Exploitable Thu, 11 Jun 2026 08:31:18 GMT https://vulnogram.org/CVE-2026-6657 https://vulnogram.org/CVE-2026-6657 A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used. The issue arises from the use of `re.match()` for validating the `Origin` header,… Medium Network Exploitable Wed, 03 Jun 2026 15:06:56 GMT https://vulnogram.org/CVE-2026-5241 https://vulnogram.org/CVE-2026-5241 A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` param… High Network Exploitable Wed, 03 Jun 2026 12:33:10 GMT https://vulnogram.org/CVE-2026-4035 https://vulnogram.org/CVE-2026-4035 A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint.… Critical Wed, 03 Jun 2026 07:18:08 GMT https://vulnogram.org/CVE-2026-5422 https://vulnogram.org/CVE-2026-5422 A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appendi… Medium Tue, 02 Jun 2026 09:11:15 GMT https://vulnogram.org/CVE-2026-3514 https://vulnogram.org/CVE-2026-3514 In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes. Specifically, the authentication middleware exempts any URL path ending with 'health' o… High Network Exploitable Tue, 02 Jun 2026 07:28:33 GMT https://vulnogram.org/CVE-2026-3198 https://vulnogram.org/CVE-2026-3198 MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entrie… Medium Tue, 02 Jun 2026 02:50:47 GMT https://vulnogram.org/CVE-2026-4944 https://vulnogram.org/CVE-2026-4944 vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model implementation files (`vllm/model_executor/models/nemotron_vl.py` and `vllm/model_executor/models/kimi_k25.py`). This byp… High Network Exploitable Thu, 28 May 2026 18:04:05 GMT https://vulnogram.org/CVE-2026-2651 https://vulnogram.org/CVE-2026-2651 A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artif… Critical Mon, 25 May 2026 06:00:34 GMT https://vulnogram.org/CVE-2026-4372 https://vulnogram.org/CVE-2026-4372 A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_in… High Sun, 24 May 2026 13:40:40 GMT https://vulnogram.org/CVE-2026-3515 https://vulnogram.org/CVE-2026-3515 A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the `reference` field. The `reference` field is concatenated directly in… High Sun, 24 May 2026 03:32:32 GMT https://vulnogram.org/CVE-2026-2734 https://vulnogram.org/CVE-2026-2734 In mlflow/mlflow versions up to 3.9.0, the `SearchModelVersions` REST API endpoint and the `mlflowSearchModelVersions` GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user t… Medium Thu, 21 May 2026 03:49:38 GMT https://vulnogram.org/CVE-2026-2611 https://vulnogram.org/CVE-2026-2611 In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow… Critical Network Exploitable Tue, 19 May 2026 09:16:42 GMT https://vulnogram.org/CVE-2026-4137 https://vulnogram.org/CVE-2026-4137 In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissions (0o777), and the `_create_model_downloading_tmp_dir()` function in `ml… High Mon, 18 May 2026 20:26:23 GMT https://vulnogram.org/CVE-2026-2652 https://vulnogram.org/CVE-2026-2652 A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission… High Network Exploitable Fri, 15 May 2026 02:13:19 GMT https://vulnogram.org/CVE-2026-2614 https://vulnogram.org/CVE-2026-2614 A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when… High Network Exploitable Mon, 11 May 2026 19:02:46 GMT https://vulnogram.org/CVE-2026-2393 https://vulnogram.org/CVE-2026-2393 A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` accepts a user-controlled `url` parameter without validation, and the `_send_webhook_request(… High Mon, 11 May 2026 16:30:04 GMT https://vulnogram.org/CVE-2026-3960 https://vulnogram.org/CVE-2026-3960 A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism… Medium Network Exploitable Thu, 23 Apr 2026 08:47:48 GMT https://vulnogram.org/CVE-2026-1462 https://vulnogram.org/CVE-2026-1462 A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`. This bypasses the security guarante… High Network Exploitable Mon, 13 Apr 2026 14:55:28 GMT https://vulnogram.org/CVE-2026-1116 https://vulnogram.org/CVE-2026-1116 A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of sanitization or HTML encoding of the `content` fi… High Network Exploitable Sun, 12 Apr 2026 02:22:52 GMT https://vulnogram.org/CVE-2026-1115 https://vulnogram.org/CVE-2026-1115 A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the `create_post` function within `backend/routers/social/__init__.py`… Critical Network Exploitable Fri, 10 Apr 2026 06:23:13 GMT https://vulnogram.org/CVE-2026-1163 https://vulnogram.org/CVE-2026-1163 An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue aris… Medium Wed, 08 Apr 2026 02:20:50 GMT https://vulnogram.org/CVE-2026-5627 https://vulnogram.org/CVE-2026-5627 A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the `AgentFlows` component. The vulnerability arises from improper handling of user input in the `loadFlow` and `deleteFlow` methods in `se… Critical Tue, 07 Apr 2026 13:06:38 GMT https://vulnogram.org/CVE-2026-1114 https://vulnogram.org/CVE-2026-1114 In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerability allows an attacker to perform an offline brute-f… Critical Network Exploitable Tue, 07 Apr 2026 06:19:05 GMT https://vulnogram.org/CVE-2026-1839 https://vulnogram.org/CVE-2026-1839 A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_… Medium Tue, 07 Apr 2026 05:22:00 GMT https://vulnogram.org/CVE-2026-0545 https://vulnogram.org/CVE-2026-0545 In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is e… Critical Network Exploitable Fri, 03 Apr 2026 17:03:12 GMT https://vulnogram.org/CVE-2026-0596 https://vulnogram.org/CVE-2026-0596 A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shel… Critical Tue, 31 Mar 2026 14:25:27 GMT