HiddenLayer

Latest CVEs · RSS

• CVE-2026-87988 2026-09-11 · CVSS 10.0
  An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowe
• CVE-2026-87987 2026-09-11 · CVSS 10.0
  An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments precedin
• CVE-2026-87986 2026-09-11 · CVSS 10.0
  An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot inter
• CVE-2026-87985 2026-09-11 · CVSS 10.0
  An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments
• CVE-2026-87984 2026-09-11 · CVSS 9.3
  An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace
• CVE-2026-87983 2026-09-11 · CVSS 9.2
  An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute pat
• CVE-2026-79721 2026-09-08 · CVSS 8.6
  Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary c
• CVE-2026-79720 2026-08-27 · CVSS 6.8
  Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning o
• CVE-2026-79719 2026-08-27 · CVSS 6.8
  Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning o
• CVE-2026-79718 2026-08-27 · CVSS 6.8
  Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning o
• CVE-2026-45833 2026-06-12 · CVSS 9.4
  A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by
• CVE-2026-45832 2026-06-12 · CVSS 8.8
  All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass au
• CVE-2026-45831 2026-06-12 · CVSS 8.8
  The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given perm
• CVE-2026-8828 2026-06-12 · CVSS 8.8
  A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or
• CVE-2026-45830 2026-06-12 · CVSS 8.8
  A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update,
• CVE-2026-45829 2026-05-18 · CVSS 10.0
  A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary
• CVE-2026-3071 2026-02-26 · CVSS 8.4
  Deserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to latest are vulnerable to arbitrary code execution when loading a ma
• CVE-2025-62354 2025-11-26 · CVSS 9.8
  Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are o
• CVE-2025-62356 2025-10-17 · CVSS 7.5
  A path traversal vulnerability in all versions of the Qodo Qodo Gen IDE enables a threat actor to read arbitrary local files in and outside of current projects
• CVE-2025-62353 2025-10-17 · CVSS 9.8
  A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary local files in and outside of current proj
• CVE-2025-49655 2025-10-17 · CVSS 9.8
  Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously up
• CVE-2025-49653 2025-06-09 · CVSS 8.0
  Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform.
• CVE-2025-49652 2025-06-09 · CVSS 9.8
  Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when r
• CVE-2025-49651 2025-06-09 · CVSS 8.1
  Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the sessio
• CVE-2024-45858 2024-09-18 · CVSS 7.8
  An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML fi