CRITICAL9.8CVE-2026-31072EPSS 0.18%APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization
CRITICAL9.6CVE-2026-45758Malicious code in guardrails-ai 0.10.1 (supply chain compromise)
CRITICAL9.6CVE-2026-2587GlassFish's gadget handler is vulnerable to RCE
CRITICAL9.8CVE-2026-7304EPSS 0.43%SGLang: Unauthenticated RCE via --enable-custom-logit-processor
CRITICAL9.1CVE-2026-7302EPSS 0.10%SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability
CRITICAL9.8CVE-2026-7301EPSS 0.06%SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket
CRITICAL9.8CVE-2026-45411EPSS 0.08%vm2 Has a Sandbox Breakout Using Async Generator
CRITICAL10.0CVE-2026-45369EPSS 0.01%utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol
CRITICAL9.6CVE-2026-45311EPSS 0.05%DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval
CRITICAL9.3CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
CRITICAL9.1CVE-2026-44650EPSS 0.10%SillyTavern has a Path Traversal issue
CRITICAL9.8CVE-2026-44649EPSS 0.09%SillyTavern has Authentication Bypass via SSO Header Injection
CRITICAL9.1CVE-2026-33117EPSS 0.03%Security feature bypass vulnerability in Azure Key Vault Keys library for Java
CRITICAL9.8CVE-2026-31239EPSS 0.05%mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub
CRITICAL9.8CVE-2026-31238EPSS 0.09%Ludwig framework is vulnerable to insecure deserialization in its model serving component
CRITICAL9.8CVE-2026-31237EPSS 0.51%Ludwig framework is vulnerable to insecure deserialization through its predict() method.
CRITICAL9.8CVE-2026-31236EPSS 0.10%llm CLI tool contains a code injection vulnerability via `--functions` command-line argument
CRITICAL9.8CVE-2026-31235EPSS 0.09%imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module
CRITICAL9.8CVE-2026-31234EPSS 0.73%Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component
CRITICAL9.8CVE-2026-31233EPSS 0.38%Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism
CRITICAL9.1CVE-2026-43515EPSS 0.10%Apache Tomcat - Security constraints not correctly applied