CVE Vulnerability Catalog

YAML::Syck versions before 1.38 for Perl have an out-of-bounds read issue. This bug occurs in the base60 parsing code, potentially leading to unsafe memory reads.

JunoClaw is an AI platform that prior to version 0.x.y-security-1 had an SSRF vulnerability in the WAVS bridge. The computeDataVerify function called fetch() on agent-supplied URLs without validating scheme, port, or resolved IP.

JunoClaw is an AI platform that prior to version 0.x.y-security-1 had a vulnerability in its substring-based blocklist for command safety checks. This could be bypassed, allowing unauthorized command execution on the host.

JunoClaw is an AI platform that prior to version 0.x.y-security-1 had a vulnerability in the plugin-shell where agent-supplied commands were interpreted by the shell, allowing shell metacharacters to be used. This vulnerability is fixed in version 0.x.y-security-1.

JunoClaw is an AI platform that prior to version 0.x.y-security-1 had a vulnerability in the upload_wasm MCP tool, allowing file uploads without validation of the path, symlink targets, file size, or file format.

Improper access control for some Intel Vision software for all versions within Ring 3: User Applications may allow a denial of service. An unprivileged software adversary with an unauthenticated user may enable remote code execution.

CVE-2026-20879 is a vulnerability related to an out-of-bounds write in the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2. This may lead to denial of service and data corruption with local access by a privileged user.

Integer overflow in the UEFI firmware for the Slim Bootloader may allow an escalation of privilege. A system software adversary with privileged access and a low complexity attack may enable local code execution.

A vulnerability in the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 allows for out-of-bounds read, potentially leading to denial of service. A privileged user adversary may exploit this vulnerability to expose data.

CVE-2026-20738 is a vulnerability related to untrusted pointer dereference in Intel(R) QuickAssist Adapter 8960 software before version 1.13, which may lead to privilege escalation. An attacker with low complexity requirements can exploit this flaw to gain higher privileges without user interaction.

Improper input validation in Intel Endpoint Management Assistant (EMA) software before version 1.14.5 within Ring 3: User Applications may allow an escalation of privilege. An unauthenticated user with low complexity attack can achieve privilege escalation via adjacent access without user interaction.

The vulnerability related to improper handling of case sensitivity in LockOutRealm in Apache Tomcat may lead to unauthorized access. It affects versions from 11.0.0-M1 to 11.0.21, from 10.1.0-M1 to 10.1.54, from 9.0.0.M1 to 9.0.117, from 8.5.0 to 8.5.100, and from 7.0.0 to 7.0.109.

A vulnerability in Apache Tomcat related to the exposure of the HTTP Authentication Header to unexpected hosts during WebSocket authentication. It affects versions from 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.2 to 9.0.117, 8.5.24 to 8.5.100, and 7.0.83 to 7.0.109.

There is a vulnerability in Apache Tomcat related to resource allocation without limits or throttling. This affects versions from 11.0.0-M1 to 11.0.21, from 10.1.0-M1 to 10.1.54, and from 9.0.0.M1 to 9.0.117.

The superduper project up to version 0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_part() function in query.py uses the unsafe eval() function to dynamically evaluate user-supplied query operands without proper sanitization.

The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability in the MultitaskClassifier.load() method. This method loads model weight files without enabling the security-restrictive weights_only=True parameter, allowing the deserialization of arbitrary Python objects.

The snorkel library thru v0.10.0 contains a critical insecure deserialization vulnerability in the BaseLabeler.load() method. This method loads serialized labeler models using the unsafe pickle.load() function on user-supplied file paths without any validation.

The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability in the Trainer.load() method. This method loads model checkpoint files without enabling the security-restrictive weights_only=True parameter, allowing deserialization of arbitrary Python objects.

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() method calls torch.load() without setting the security-restrictive weights_only=True parameter, allowing deserialization of arbitrary Python objects.

The _load_model() function in the neural_magic_training.py script of the optimate project is vulnerable to insecure deserialization. This allows a malicious attacker to execute arbitrary code on the victim's system by providing a crafted model file.