Vendor
critical
advisory
Unauthenticated Remote Code Execution in Xorbits Xoscar
1 TTP 1 CVEXorbits Xoscar versions 0.11.2 and earlier are vulnerable to unauthenticated remote code execution via insecure deserialization of data sent over the actor-pool TCP channel.
Xoscar
remote-code-execution
deserialization
vulnerability
cve-2026-49950
1t
1c
high
advisory
Unauthenticated Arbitrary File Read in Xinference
1 rule 1 TTP 1 CVEXinference versions 3.x and commit 4a94832 contain an unauthenticated arbitrary file read vulnerability via the model_path parameter in the auto-register endpoint.
Xinference
vulnerability
file-read
webserver
1r
1t
1c