CVE-2026-100308

Publié : 29 septembre 2026

Modifié : 29 septembre 2026

Score CVSS

7.8

HIGH

Description détaillée

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to version 0.17.0 or later.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Références et Patchs

https://aws.amazon.com/security/security-bulletins/2026-119-aws/https://github.com/awslabs/gluonts/releases/tag/v0.17.0 https://github.com/awslabs/gluonts/security/advisories/GHSA-64q6-5qv7-cwj9

Dernières Vulnérabilités

CVE-2026-95385

Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

VOIR DÉTAILS

CVE-2026-95384

Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

VOIR DÉTAILS

CVE-2026-95382

Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

VOIR DÉTAILS