CVE-2026-10801

LowCVSS 3.6/10Last modified Jul 22, 2026

Description

A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template._save_pil_image of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.

Metrics

CVSS 3.1 3.6/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-327 CWE-328

Affected software

Vendor	Product	Versions
modelscope	ms-swift	4.0; 4.1; 4.2.0

References

Timeline

Published: Jun 4, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1080136.8BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose priv CVE-2026-1080149.1Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts ce CVE-2026-1080159.1Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts ce CVE-2026-1080186.3The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction. A client-side configuration file d CVE-2026-108024.3A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src CVE-2026-108033.6A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.CVE-2026-1080397.5By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large req CVE-2026-108044.7A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashi CVE-2026-1080417.1The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an CVE-2026-1080466.9Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By mod CVE-2026-1080478.6Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properl CVE-2026-1080486.9Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enfor