Cyber Risks October 28, 2026 · Zero Day Initiative

ZDI-26-815: (0Day) Ultralytics parse_model Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118616.

Read the original at Zero Day Initiative ↗

Topics

Supply Chain & AppSec

Mentions

CVE-2026-118616

Related

Kitesurf is now open source Cyber Risks · Nov 13, 2026

Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026

ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026