Topic · 6 stories
6 stories tagged cve on AI Tamer, newest first.
CVE-2026-115812 (CVSS 9.8) lets a crafted model archive write files outside its folder. MMS is end of life, so AWS says migrate. No fix is planned.
Pillow 13.0.0 lists 38 security fixes, two rated critical, including EPS argument injection and a JPEG bug Anthropic found with Claude. Upgrade and rebuild.
JFrog rates CVE-2026-105192 at 9.8 for pickle on LMCache's multiprocess ZeroMQ socket when that socket is routable. No release removes the path. Pull request 5644 is open and unmerged.
NVIDIA's bulletin rates CVE-2026-47483 at 8.2: unauthenticated pprof requests can exhaust DCGM Exporter. Lava found about 2,100 hosts exposing exporter metrics. NVIDIA lists 4.8.2 as the fix.
JVN#22475874 (2026-09-29): seven Pgpool-II CVEs; lead CVE-2026-92867 authenticated OOB write (CVSS 4.0 8.7 / 3.0 8.8)—process termination and arbitrary code execution. Fixed in 4.7.3, 4.6.8, 4.5.13, 4.4.18, 4.3.21.
PgBouncer 1.26.0 (Sep 23, 2026) fixes CVE-2026-19888, CVE-2026-6668, and CVE-2026-6669 (DoS only: crash, infinite loop, unbounded login work; no RCE or CVSS). Also: pool_idle_timeout and query_wait_timeout; -R removed.
