VU#369093: MLflow dspy and statsmodels flavors bypass pickle deserialization control
2026-09-16T20:52:01Z•918d7939b5050a6b3431aff37f9f3043f98870d7c76d66627caa26edf3528085
CVE-2025-20701CVE-2026-12780CVE-2026-84282CVE-2026-84286CVE-2026-90999BluetoothCERT/CCCUDAMLflowONLYOFFICESSRFSecure-Boot-bypassSentry-SeerUEFIarbitrary-code-executiondenial-of-servicefirmwarekernel-driverlocal-privilege-escalationmultiple-vulnerabilitiesout-of-bounds-memory-accessownCloudpickle-deserializationprompt-injectionremote-code-executionsupply-chainunauthenticated-pairing
What happened
CERT/CC vulnerability notes describe multiple 2026 vulnerabilities across MLflow, Sentry Seer, ExLlamaV3, AOMEI Backupper, UEFI firmware, Skullcandy earbuds, and the ONLYOFFICE ownCloud integration. Impacts include arbitrary code execution, privileged coding-agent compromise, denial of service, local privilege escalation and pre-boot persistence, Secure Boot bypass, unauthorized Bluetooth pairing, and SSRF. Several entries include CVE identifiers, while others are vendor- or configuration-specific advisories.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- 918d7939b5050a6b3431aff37f9f3043f98870d7c76d66627caa26edf3528085
- Enrichment time
- 2026-09-16T20:52:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.