intended model, as it will open a different model each time. Additionally, an attacker can exploit this vulnerability to perform data model poisoning by creating a model with the same

artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue

vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead

Python code when loaded, bypassing Picklescan's safety checks and enabling supply-chain poisoning of shared model files

A vulnerability in keras-team/keras versions <= 3.15.0 allows for

Picklescan is vulnerable to RCE through missing detection when calling

Picklescan is vulnerable to RCE via missing detection when calling

llama-index-core insecurely handles temporary files

CKAN MCP Server: Cache-key canonicalization collision enables cache confusion

Open WebUI's process_files_batch() endpoint missing ownership check

MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM

Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure

Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base

Open WebUI: Redis Cache Keys tool_servers and terminal_servers

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

simple-git allows command execution through unblocked Git configuration includes

mcp-shell — Security Disabled by Default in Bare-Binary Deploy

CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

mcp-memory-service: Missing Authentication on Document API Endpoints Allows

vLLM is an inference and serving engine for large language