ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

CERT/CC

1 mentions in 7 days · 7 in 30 days · 7 total · first seen · last

Search everything

Timeline

VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index

CERT/CC details CVE-2026-84286, an out-of-bounds memory access in ExLlamaV3's CUDA extension causing denial-of-service crashes; fixed via merged pull request.

CERT/CC published VU#369611 for CVE-2026-84286, an out-of-bounds memory access in the exllamav3_ext CUDA extension of the ExLlamaV3 LLM inference library. A crafted input with kernel parameter K set to 0 produces a negative index into a fixed 24-entry kernel dispatch array, causing a CUDA illegal memory access and denial-of-service crashes. The vendor fixed the issue in the main repository via pull request #310, and maintainers of 49 downstream projects, including ezexl3 and MawDiscord, are advised to rebuild against the patched version. The issue was reported by Nathan Keys and impact is limited to crashes and instability, not code execution.

CERT/CC Vulnerability Notes · 4d agoVulnerabilityCVE-2026-842861

VU#889462: Casdoor authentication server is vulnerable to authorization bypass

Casdoor IAM versions 3.115.0 and earlier allow organization admins to bypass tenant isolation through inconsistent authorization checks, tracked as CVE-2026-15630.

CERT/CC published VU#889462 describing an authorization bypass in Casdoor, an open-source access management platform, affecting versions 3.115.0 and earlier. The flaw (CVE-2026-15630) stems from controllers ignoring the ?id= query parameter used for authorization decisions and acting on JSON body fields instead, letting a single-organization administrator perform unauthorized administrative actions against arbitrary organizations in multi-tenant deployments. Impact can escalate to complete tenant-isolation compromise and potential compromise of the entire Casdoor instance, including SSO/SAML disruption. No vendor patch is available because researchers could not reach Casdoor; mitigations include least privilege, MFA for admin accounts, and alerting on cross-organization administrative activity.

CERT/CC Vulnerability Notes · 12d agoVulnerabilityCVE-2026-15630

VU#456290: Hugging Face Transformers library writes remote code to disk prior to consent check

CVE-2026-80047: Hugging Face Transformers 4.49.0 through 5.8.1 writes attacker-controlled Python files to disk before the trust_remote_code consent check.

CERT/CC vulnerability note VU#456290 describes CVE-2026-80047 in the Hugging Face Transformers library, affecting versions 4.49.0 through 5.8.1. The library performs a remote module fetch and writes attacker-controlled Python files to the local disk before evaluating the trust_remote_code consent prompt, without user authorization. This violates the security contract enforced across other dynamic module-loading paths in the library. Transformers is a primary framework for training and inference across NLP, vision, audio, video, and multimodal machine learning systems.

CERT/CC Vulnerability Notes · 14d agoVulnerabilityCVE-2026-80047

Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

CERT/CC disclosed unpatched Kaltura mwEmbed flaws CVE-2026-19913 and CVE-2026-19912 allowing unauthenticated file reads and remote code execution.

CERT/CC disclosed two unpatched flaws in Kaltura's mwEmbed HTML5 player library, both rooted in unsafe deserialization in mwEmbedLoader.php and exploitable without authentication. CVE-2026-19913 (reporter-scored 9.1) reflects local file contents back via the ServiceUrl parameter, exposing secrets in local.ini; CVE-2026-19912 (reporter-scored 10.0) achieves PHP code execution by writing attacker-controlled objects into web-accessible directories via the uiconf_id parameter. No patch exists and CERT/CC could not reach Kaltura; affected releases include html5lib v2.45, v2.103 and earlier, with the shared multi-tenant CDN hosts also impacted. No exploitation or KEV listing was reported as of August 25, 2026.

The Hacker News · 20d agoVulnerabilityCVE-2026-19913CVE-2026-199121

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

CERT/CC Vulnerability Notes · 21d agoVulnerability

VU#756733: Calix GS7 XGS GS5239XG residential router contains missing authentication vulnerability

CERT/CC warns Calix GS7 XGS GS5239XG routers on firmware EXOS/6.6.47 expose an unauthenticated UPnP WANIPConnection service on the public WAN interface.

CERT/CC issued VU#756733 for a missing authentication vulnerability in the Calix GS7 XGS GS5239XG residential gateway running EXOS/6.6.47. The device's UPnP service, implemented with MiniUPnPd 2.3.7, is exposed on the WAN interface by default and does not require authentication, potentially letting remote attackers alter port mappings through the WANIPConnection service. The flaw affects routing, NAT, and firewall functionality for home networks.

CERT/CC Vulnerability Notes · 25d agoVulnerability

VU#874418: RDK-B WebUI contains multiple vulnerabilities

CERT/CC warns RDK-B WebUI rdkb-2025q4-kirkstone contains multiple flaws enabling network attackers to bypass authentication, cause DoS, or potentially execute code.

VU#874418 describes multiple vulnerabilities in the RDK-B WebUI version rdkb-2025q4-kirkstone, the open-source Reference Design Kit for Broadband used in broadband gateways and networking devices. Issues include memory corruption, improper authentication, race conditions, and insufficient input validation. A network-adjacent attacker could bypass authentication, obtain administrative access, cause denial-of-service, or corrupt underlying processes, with potential arbitrary code execution under certain conditions.

CERT/CC Vulnerability Notes · 27d agoVulnerability

Related CVEs

  • CVE-2026-156309.9<1%
    A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch b
    A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).
    —
  • CVE-2026-199129.8<1%
    Unauthenticated RCE in Kaltura mwEmbed HTML5 Player
    Kaltura's HTML5 player library (mwEmbed/html5lib) contains an unauthenticated remote code execution vulnerability (CVE-2026-19912) caused by unsafe PHP deserialization combined with unsanitized filesystem path construction in mwEmbedLoader.php. A remote attacker controls the ServiceUrl parameter, whose response is passed to unserialize(), and supplies a crafted uiconf_id so that fields of the resulting object are written to an attacker-influenced cache path without path validation, allowing arbitrary files to be written to web-accessible locations and code execution as the webserver user; the related advisory headline also notes the flaws could allow reading files. The flaw is rated CVSS 9.8 (critical), requiring no privileges or user interaction over the network. Any deployment serving an affected html5lib v2.x release, including v2.45, v2.103 and earlier, is affected. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS estimates only a 0.6% probability of exploitation within 30 days (46th percentile), indicating no confirmed exploitation yet.
    · Kaltura mwEmbed HTML5 player (html5lib) v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable mwEmbedLoader.php endpointlarge
  • CVE-2026-800477.8<1%
    Pre-Consent Remote Python File Write in Hugging Face Transformers
    CVE-2026-80047 is a flaw in Hugging Face Transformers (versions 4.49.0 through 5.8.1) in which GenerativePreTrainedModel.load_custom_generate() writes a remote Python file (custom_generate/generate.py) from a model repository to the local ~/.cache/huggingface/modules directory before performing the required trust_remote_code consent check. The unconditional file write in dynamic_module_utils.py occurs even when the user declines the trust prompt, inverting the consent-first model enforced by AutoConfig, AutoModel, and AutoTokenizer. Execution of the code is correctly gated, but the write is persistent, so attacker-controlled code remains on disk and can later be executed via stale-cache collisions during otherwise trusted model loads. Affected users are developers, CI pipelines, and applications running affected Transformers versions that load custom generate implementations from remote repositories. There is currently no public proof-of-concept, no known exploitation (EPSS 0.1%), and the issue is not in CISA KEV; it was assigned by CERT/CC under VU#456290.
    · Hugging Face Transformers >= 4.49.0 and <= 5.8.1niche
  • CVE-2026-199137.5<1%
    Unauthenticated Local File Disclosure in Kaltura HTML5 Player (mwEmbed)
    The Kaltura HTML5 player (mwEmbed/html5lib) fails to properly validate the ServiceUrl parameter in mwEmbedLoader.php, which is used as the base URL for a backend request and accepts non-HTTP schemes such as file://. An unauthenticated remote attacker can supply a file:// URL, and when the backend request raises an exception or error, the server deserializes the response and reflects its raw contents back to the client in an error message, disclosing arbitrary files readable by the web server user. An attacker gains read access to internal server files, which may include configuration files or credentials, with confidentiality impact only per the CVSS score. Any deployment exposing the vulnerable mwEmbedLoader.php endpoint is affected, including sites running html5lib v2.45, v2.103 and earlier, and other v2.x releases. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; EPSS is low at 0.4%, though related reporting indicates additional unpatched mwEmbed flaws, possibly including code execution, may exist.
    · Kaltura html5lib / mwEmbed HTML5 player (mwEmbedLoader.php) v2.103 and earlier (including v2.45) and other v2.x releases exposing the vulnerable mwEmbedLoader.php endpoint; no fixed release identified in available reportlarge
  • CVE-2026-84286——
    —

Appears with

organization CERT/CC 4vendor Kaltura 2organization The Hacker News 1organization Voke Cyber 1product Calix GS7 XGS GS5239XG 1product Casdoor 1product ExLlamaV3 1product exllamav3_ext 1product html5lib 1product KalturaClientBase 1product Kaltura HTML5 Player V2 1product Kaltura Player V7 1product MiniUPnPd 2.3.7 1product mwEmbed 1product RDK-B WebUI 1product Transformers 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.