Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing
CVE-2026-61539
### Summary Xinference used Python's unsafe `eval()` function when parsing Llama3 tool-call output generated by a large
#severity:critical
共收录 1468 条相关情报。
← 返回所有主题Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)
CVE-2026-59989
## Summary The Volt template compiler in Phalcon generates the PHP for the `join` filter by string-concatenating the fi
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
CVE-2026-76904
### Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementat
llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's...
CVE-2026-39909
llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE handler that allows u
Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom...
CVE-2026-75932
Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authent
Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to...
CVE-2026-69502
Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a ne
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth...
CVE-2026-77812
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encry
Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing...
CVE-2026-77087
Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbit
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as...
CVE-2026-77647
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC...
CVE-2026-77645
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerabili
A critical bypass access control vulnerability has been reported in PTC Windchill Risk and...
CVE-2026-77644
A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to...
CVE-2026-69836
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
The customer update route in EverShop is declared with "access": "public" in packages/evershop...
CVE-2026-72843
The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/
Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to...
CVE-2026-69851
Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a...
CVE-2026-69555
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker...
CVE-2026-65801
Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges ov
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to...
CVE-2026-18835
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands
Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to...
CVE-2026-65816
Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a
Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized...
CVE-2026-62834
Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privil
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL...
CVE-2026-68782
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an aut