Disclosures

2 reported

2026-07-01 CTranslate2 Model Loader Heap Overflows Two heap overflows in CTranslate2's model loader: an out-of-bounds read from a string field with no null terminator, and an out-of-bounds write from a tensor length that is never checked against the buffer size. Both are reachable by loading a crafted model file. Fixed in PR #2068. High → 2026-02-07 WordPress Backdoor (CVE-2026-6443) Unauthenticated remote code execution. A backdoored plugin update added a public REST endpoint that fetches a payload from attacker infrastructure and passes it to unserialize(), leading to PHP object injection and code execution. CVSS 9.8, across every plugin from the compromised account. Critical →