Aeon
Monthly
Arbitrary code execution in aeon 1.3.0 is triggered when a user loads a maliciously crafted CSV dataset file via the `load_time_series_segmentation_benchmark` or `load_human_activity_segmentation_datasets` functions, both of which passed CSV column values directly to Python's `eval()` built-in without validation. An attacker who convinces a data scientist or researcher to open a crafted dataset file can execute arbitrary Python code with the privileges of the running process. No public exploit has been identified at time of analysis, but the upstream fix commit is public and the vulnerability class is trivially replicable given the use of bare `eval()`.
Remote code execution in aeon 1.3.0 is possible when a user loads a maliciously crafted CSV dataset via the `load_human_activity_segmentation_datasets` or `load_time_series_segmentation_benchmark` functions, which pass unvalidated column values directly to Python's `eval()`. An attacker who can deliver a malicious file or dataset URL to a target data scientist can execute arbitrary Python code in the victim's process with their full privileges. No public exploit has been identified at time of analysis, though ZDI (ZDI-CAN-29160) holds technical details; the upstream fix replacing `eval()` with `ast.literal_eval()` is available as a commit but a tagged patched release has not been independently confirmed.
Remote code execution in Aeon 1.3.0 is triggered when a user loads a maliciously crafted dataset file via the load_rehab_pile_dataset function, which called numpy's np.load() with allow_pickle=True - enabling full Python pickle deserialization of attacker-controlled content. Reported by Zero Day Initiative (ZDI-CAN-28749 / ZDI-26-468) and tracked as EUVD-2026-63433, the vulnerability carries CVSS 7.8 with full confidentiality, integrity, and availability impact limited by local attack vector and required user interaction. No public exploit has been identified at time of analysis, and an upstream patch commit is available but a tagged release version has not been independently confirmed.
WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Atlas Systems Aeon 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) Action or (2) Form parameter to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Arbitrary code execution in aeon 1.3.0 is triggered when a user loads a maliciously crafted CSV dataset file via the `load_time_series_segmentation_benchmark` or `load_human_activity_segmentation_datasets` functions, both of which passed CSV column values directly to Python's `eval()` built-in without validation. An attacker who convinces a data scientist or researcher to open a crafted dataset file can execute arbitrary Python code with the privileges of the running process. No public exploit has been identified at time of analysis, but the upstream fix commit is public and the vulnerability class is trivially replicable given the use of bare `eval()`.
Remote code execution in aeon 1.3.0 is possible when a user loads a maliciously crafted CSV dataset via the `load_human_activity_segmentation_datasets` or `load_time_series_segmentation_benchmark` functions, which pass unvalidated column values directly to Python's `eval()`. An attacker who can deliver a malicious file or dataset URL to a target data scientist can execute arbitrary Python code in the victim's process with their full privileges. No public exploit has been identified at time of analysis, though ZDI (ZDI-CAN-29160) holds technical details; the upstream fix replacing `eval()` with `ast.literal_eval()` is available as a commit but a tagged patched release has not been independently confirmed.
Remote code execution in Aeon 1.3.0 is triggered when a user loads a maliciously crafted dataset file via the load_rehab_pile_dataset function, which called numpy's np.load() with allow_pickle=True - enabling full Python pickle deserialization of attacker-controlled content. Reported by Zero Day Initiative (ZDI-CAN-28749 / ZDI-26-468) and tracked as EUVD-2026-63433, the vulnerability carries CVSS 7.8 with full confidentiality, integrity, and availability impact limited by local attack vector and required user interaction. No public exploit has been identified at time of analysis, and an upstream patch commit is available but a tagged release version has not been independently confirmed.
WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Atlas Systems Aeon 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) Action or (2) Form parameter to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.