CRITICAL9.8CVE-2026-8711EPSS 0.10%NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (fo…
CRITICAL9.8EPSS 0.43%SGLang: Unauthenticated RCE via --enable-custom-logit-processor
CRITICAL9.1EPSS 0.10%SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability
CRITICAL9.8EPSS 0.06%SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket
CRITICAL10.0EPSS 0.01%utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol
CRITICAL9.8EPSS 0.05%mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub
CRITICAL9.8EPSS 0.09%Ludwig framework is vulnerable to insecure deserialization in its model serving component
CRITICAL9.8EPSS 0.51%Ludwig framework is vulnerable to insecure deserialization through its predict() method.
CRITICAL9.8EPSS 0.10%llm CLI tool contains a code injection vulnerability via `--functions` command-line argument
CRITICAL9.8EPSS 0.09%imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module
CRITICAL9.8EPSS 0.73%Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component
CRITICAL9.8EPSS 0.38%Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism
CRITICAL9.8EPSS 0.31%PySyft server-side arbitrary Python execution after code approval
CRITICAL9.9EPSS 0.06%pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules