GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.
A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely. The exploit has been made public and could be used.
Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute commands in their own sandbox can reach other tenants' sandbox APIs, access their files and secrets, execute commands in active sandboxes, and enumerate, create, or delete sandboxes through the unauthenticated provisioner without knowing administrator, database, or MinIO credentials. Sandboxes can also reach shared internal services; if shipped default service credentials remain unchanged, an attacker can use them, and if the exposed PostgreSQL account is a superuser, obtain command execution in the PostgreSQL container. These paths can disclose or modify cross-tenant data and sandbox state or cause denial of service through sandbox deletion without a container escape or kernel vulnerability. This vulnerability is fixed in 0.7.1. Existing deployments must separately rotate persisted PostgreSQL, Neo4j, or MinIO credentials that were previously set to documented or shipped defaults because upgrading the Compose files does not automatically rotate them.
Jan versions from 0.8.5 up to but not including 0.8.8 have a vulnerability that allows attackers to bypass workspace protections and write files outside the intended workspace by exploiting dangling symbolic links. This can be triggered by supplying a malicious repository and using prompt injection to cause file write or edit tools to follow symlinks, potentially creating sensitive files such as ~/.ssh/authorized_keys on the host system.
jsondiffpatch versions before 0.7.7 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious markup by providing an unescaped array-move destination index in a delta object. Exploitation requires control over the delta passed to the formatters.html.format() or formatters.annotated.format() functions, enabling script execution in the application's origin context. The vulnerability is fixed in version 0.7.7.
CVE-2026-122233 is an information disclosure vulnerability in FrankenPHP versions before 1.13.4. The flaw occurs in worker mode where the last HTTP stream response headers are not cleared between requests because the reset only happens during RSHUTDOWN, which worker requests skip. This allows subsequent requests on the same worker thread to access headers from previous requests, potentially exposing sensitive headers such as Set-Cookie or tokens from backend APIs.
CVE-2026-16725 is a path traversal vulnerability in IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0. This flaw allows a remote authenticated attacker to read arbitrary files on the local filesystem. The vulnerability does not require user interaction and impacts confidentiality but not integrity or availability.
CVE-2026-19319 is an out-of-bounds read vulnerability in IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0. This flaw could allow a remote attacker to obtain sensitive information without requiring authentication or user interaction. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-82418 is a critical use-after-free vulnerability in IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0. This flaw could allow a remote attacker to execute arbitrary code without any user interaction or privileges.
CVE-2026-17493 is an out-of-bounds read vulnerability in IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0. This flaw could be exploited remotely to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but results in service disruption.
CVE-2026-122014 is a code injection vulnerability in the NPC-Worldwide npcpy software, specifically affecting the load_sft_model function in the npcpy/ft/sft.py file. The vulnerability arises from improper handling of the base_model_name_or_path argument, allowing remote attackers to inject code. The flaw affects multiple versions up to 2.1.19. The vulnerability has a medium severity rating and public exploit details have been disclosed.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability where error messages expose sensitive internal implementation details. This information disclosure could be exploited by a remote authenticated attacker to gain sensitive information. The vulnerability is classified under CWE-209 and has a medium severity with a CVSS score of 4.3.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 have a vulnerability where a missing Content Security Policy (CSP) header could allow a remote authenticated attacker to bypass certain security restrictions. The issue is classified under CWE-693, indicating a protection mechanism failure. The vulnerability has a low severity score of 3.5 and does not impact confidentiality, integrity, or availability significantly.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability where improper restriction of rendered UI layers or frames allows a remote authenticated attacker to bypass security restrictions. This issue could lead to limited confidentiality and integrity impacts but does not affect availability. The vulnerability has a medium severity rating with a CVSS score of 4.6.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 have a security vulnerability where the absence of the X-Content-Type-Options header allows MIME type sniffing. This can enable a remote authenticated attacker to bypass security restrictions. The vulnerability is classified under CWE-693 (Protection Mechanism Failure) and has a medium severity rating with a CVSS score of 5.4.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows remote authenticated attackers to perform HTTP response splitting due to improper neutralization of HTTP headers. This vulnerability is identified as CWE-113 and has a medium severity rating with a CVSS score of 4.3.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a local attacker to cause a denial of service by triggering uncontrolled resource consumption. The vulnerability is identified as CWE-400 and results in availability impact without affecting confidentiality or integrity.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability due to a missing required cryptographic step. This flaw could allow a remote authenticated attacker to obtain sensitive information. The vulnerability has a medium severity rating with a CVSS score of 4.3.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability due to improper TLS certificate validation. This flaw could allow an attacker to perform a man-in-the-middle attack to obtain sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.9.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain an improper access control vulnerability that allows a remote authenticated attacker to bypass security restrictions. This flaw could lead to unauthorized modification of data or system state without impacting confidentiality or availability.