A'Tuin AI Advisories advisories Public vulnerability discoveries disclosed by A'Tuin AI. en Thu, 16 Jul 2026 05:53:18 GMT CVE-2026-61539: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing https://github.com/xorbitsai/inference/security/advisories/GHSA-x2rj-828p-hx9m CVE-2026-61539 Mon, 13 Jul 2026 00:00:00 GMT CWE-95 Product: pip xinference (pip); CVSS: 10 critical; Weakness: CWE-95; Affected versions: <= 2.5.0 CVE-2026-41252: Heap-based Buffer Overflow in xrdp vnc-any mode https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-w5vg-6qmv-j63j CVE-2026-41252 Thu, 02 Jul 2026 00:00:00 GMT CWE-122 Product: xrdp; CVSS: 9.8 critical; Weakness: CWE-122; Affected versions: <= 0.10.6 CVE-2026-44178: Heap-based Buffer Overflow in xrdp Virtual Channel Forwarding https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hh7r-2rmq-q4g4 CVE-2026-44178 Thu, 02 Jul 2026 00:00:00 GMT CWE-122 Product: xrdp; CVSS: 8.8 high; Weakness: CWE-122; Affected versions: <= 0.10.6 CVE-2026-46695: BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files https://www.cve.org/CVERecord?id=CVE-2026-46695 CVE-2026-46695 Wed, 10 Jun 2026 00:00:00 GMT CWE-284 Product: boxlite-ai boxlite; CVSS: 10 critical; Weakness: CWE-284; Affected versions: < 0.9.0 CVE-2026-46703: BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Host https://www.cve.org/CVERecord?id=CVE-2026-46703 CVE-2026-46703 Wed, 10 Jun 2026 00:00:00 GMT CWE-22 Product: boxlite-ai boxlite; CVSS: 9.6 critical; Weakness: CWE-22; Affected versions: < 0.9.0 CVE-2026-47213: BoxLite: Timeout Bypass Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-47213 CVE-2026-47213 Wed, 10 Jun 2026 00:00:00 GMT CWE-404 Product: boxlite-ai boxlite; CVSS: 6.5 medium; Weakness: CWE-404; Affected versions: <= 0.8.2 CVE-2026-6475: PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice https://www.cve.org/CVERecord?id=CVE-2026-6475 CVE-2026-6475 Thu, 14 May 2026 00:00:00 GMT CWE-61 Product: PostgreSQL; CVSS: 8.8 high; Weakness: CWE-61; Affected versions: < 18.4, < 17.10, < 16.14, < 15.18, < 14.23 CVE-2026-28978: A permissions issue was addressed with additional restrictions https://www.cve.org/CVERecord?id=CVE-2026-28978 CVE-2026-28978 Mon, 11 May 2026 00:00:00 GMT CWE-284 Product: Apple macOS; CVSS: 8.8 high; Weakness: CWE-284; Affected versions: < 14.8.7, < 15.7.7, < 26.5 CVE-2026-5807: Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations https://www.cve.org/CVERecord?id=CVE-2026-5807 CVE-2026-5807 Fri, 17 Apr 2026 00:00:00 GMT CWE-770 Product: HashiCorp Vault, HashiCorp Vault Enterprise; CVSS: 7.5 high; Weakness: CWE-770; Affected versions: < 2.0.0, < 2.0.0. CVE-2025-14813: GOSTCTR implementation unable to process more than 255 blocks correctly https://www.cve.org/CVERecord?id=CVE-2025-14813 CVE-2025-14813 Wed, 15 Apr 2026 00:00:00 GMT CWE-327 Product: Legion of the Bouncy Castle Inc. BC-JAVA; CVSS: 9.3 critical; Weakness: CWE-327; Affected versions: < 1.80.2, < 1.81.1, < 1.84 CVE-2026-20688: A path handling issue was addressed with improved validation https://www.cve.org/CVERecord?id=CVE-2026-20688 CVE-2026-20688 Wed, 25 Mar 2026 00:00:00 GMT CWE-22 Product: Apple iOS and iPadOS, Apple macOS, Apple visionOS; CVSS: 9.3 critical; Weakness: CWE-22; Affected versions: < 26.4, < 14.8.5, < 15.7.5 CVE-2026-27483: MindsDB has Path Traversal in /api/files Leading to Remote Code Execution https://www.cve.org/CVERecord?id=CVE-2026-27483 CVE-2026-27483 Tue, 24 Feb 2026 00:00:00 GMT CWE-22 Product: mindsdb mindsdb; CVSS: 8.8 high; Weakness: CWE-22; Affected versions: < 25.9.1.1 CVE-2026-26007: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves https://www.cve.org/CVERecord?id=CVE-2026-26007 CVE-2026-26007 Tue, 10 Feb 2026 00:00:00 GMT CWE-345 Product: pyca cryptography; CVSS: 8.2 high; Weakness: CWE-345; Affected versions: < 46.0.5 CVE-2026-25160: Alist has Insecure TLS Config https://www.cve.org/CVERecord?id=CVE-2026-25160 CVE-2026-25160 Wed, 04 Feb 2026 00:00:00 GMT CWE-295 Product: AlistGo alist; CVSS: 9.1 critical; Weakness: CWE-295; Affected versions: < 3.57.0 CVE-2026-25161: Alist vulnerable to Path Traversal in multiple file operation handlers https://www.cve.org/CVERecord?id=CVE-2026-25161 CVE-2026-25161 Wed, 04 Feb 2026 00:00:00 GMT CWE-22 Product: AlistGo alist; CVSS: 8.8 high; Weakness: CWE-22; Affected versions: < 3.57.0 CVE-2026-25059: OpenList affected by Path Traversal in file copy and remove handlers https://www.cve.org/CVERecord?id=CVE-2026-25059 CVE-2026-25059 Mon, 02 Feb 2026 00:00:00 GMT CWE-22 Product: OpenListTeam OpenList; CVSS: 8.8 high; Weakness: CWE-22; Affected versions: < 4.1.10 CVE-2026-25060: OpenList Insecure TLS Default Configuration https://www.cve.org/CVERecord?id=CVE-2026-25060 CVE-2026-25060 Mon, 02 Feb 2026 00:00:00 GMT CWE-599 Product: OpenListTeam OpenList; CVSS: 8.1 high; Weakness: CWE-599; Affected versions: < 4.1.10 CVE-2026-23965: sm-crypto Affected by Signature Forgery in SM2-DSA https://www.cve.org/CVERecord?id=CVE-2026-23965 CVE-2026-23965 Thu, 22 Jan 2026 00:00:00 GMT CWE-347 Product: JuneAndGreen sm-crypto; CVSS: 7.5 high; Weakness: CWE-347; Affected versions: < 0.4.0 CVE-2026-23966: sm-crypto Affected by Private Key Recovery in SM2-PKE https://www.cve.org/CVERecord?id=CVE-2026-23966 CVE-2026-23966 Thu, 22 Jan 2026 00:00:00 GMT CWE-345 Product: JuneAndGreen sm-crypto; CVSS: 9.1 critical; Weakness: CWE-345; Affected versions: < 0.3.14 CVE-2026-23967: sm-crypto Affected by Signature Malleability in SM2-DSA https://www.cve.org/CVERecord?id=CVE-2026-23967 CVE-2026-23967 Thu, 22 Jan 2026 00:00:00 GMT CWE-347 Product: JuneAndGreen sm-crypto; CVSS: 7.5 high; Weakness: CWE-347; Affected versions: < 0.3.14 CVE-2026-22698: RustCrypto SM2-PKE has 32-bit Biased Nonce Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-22698 CVE-2026-22698 Sat, 10 Jan 2026 00:00:00 GMT CWE-331 Product: RustCrypto elliptic-curves; CVSS: 8.7 high; Weakness: CWE-331; Affected versions: = 0.14.0-pre.0, = 0.14.0-rc.0 CVE-2026-22699: RustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt() https://www.cve.org/CVERecord?id=CVE-2026-22699 CVE-2026-22699 Sat, 10 Jan 2026 00:00:00 GMT CWE-20 Product: RustCrypto elliptic-curves; CVSS: 7.5 high; Weakness: CWE-20; Affected versions: = 0.14.0-pre.0, = 0.14.0-rc.0 CVE-2026-22700: RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE https://www.cve.org/CVERecord?id=CVE-2026-22700 CVE-2026-22700 Sat, 10 Jan 2026 00:00:00 GMT CWE-20 Product: RustCrypto elliptic-curves; CVSS: 7.5 high; Weakness: CWE-20; Affected versions: = 0.14.0-pre.0, = 0.14.0-rc.0 CVE-2025-61913: Flowise is vulnerable to arbitrary file read, arbitrary file write https://www.cve.org/CVERecord?id=CVE-2025-61913 CVE-2025-61913 Wed, 08 Oct 2025 00:00:00 GMT CWE-22 Product: FlowiseAI Flowise; CVSS: 10 critical; Weakness: CWE-22; Affected versions: < 3.0.8 CVE-2025-57801: gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks https://www.cve.org/CVERecord?id=CVE-2025-57801 CVE-2025-57801 Fri, 22 Aug 2025 00:00:00 GMT CWE-347 Product: Consensys gnark; CVSS: 8.6 high; Weakness: CWE-347; Affected versions: < 0.14.0