CVE-2026-126995

MediumCVSS 6.3/10Last modified Nov 12, 2026

Description

A vulnerability was found in tjake Jlama up to 0.8.4/0.9.0-beta. Affected by this vulnerability is the function SafeTensorIndex.loadWeights of the file jlama-core/src/main/java/com/github/tjake/jlama/safetensors/SafeTensorIndex.java. Performing a manipulation of the argument weight_map results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1269966.3A vulnerability was determined in SakanaAI text-to-LoRA 0.0.1. Affected by this issue is the function get_tokenizer of the file src/hyper_ll CVE-2026-1269977.3A vulnerability was identified in JeecgBoot up to 3.9.6. This affects the function RestTemplate.exchange of the file org/jeecg/modules/airag CVE-2026-1269987.3A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /op CVE-2026-127019.0A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin wit CVE-2026-1270169.2The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that di CVE-2026-127024.9In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deploymen CVE-2026-1270297.5A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling au CVE-2026-127038.0TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to by CVE-2026-1270307.5A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session tic CVE-2026-1270368.6Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS. This issue affects WebFOCUS: 9.1, from 9.2 thro CVE-2026-127046.8When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML resp CVE-2026-1270469.2The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /externa