CVE WatchJul 14, 2026

CVE-2026-15605

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wand

CVSS

3.1

Low

EPSS

0.2%

p13

KEV

—

Exploit Today

0-100

Published: Jul 13, 2026 · Last modified: Jul 14, 2026 · CWE-327 · CWE-328

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-09-222026-10-19

Technical description

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The pull request to fix this issue awaits acceptance.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-31615.9 MED

—

——0IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.1d CVE-2026-69303.7 LOW

—

——0IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.1d CVE-2026-591166.8 MED

28.8%

——9Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over a network.7d CVE-2026-651047.1 HIG

3.0%

——1NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. A successful exploit of this vulnerability might lead to data tampering and partial information disclosure.7d CVE-2026-974689.1 CRI

7.8%

——2Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/hashCode()), and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token (for example a UsernameToken or a self-signed SAML Assertion) whose hash collides with a cached entry. The token would then be accepted without password validation, signature trust verification or a call to the STS. This could let the attacker authenticate as another user and, through STS token validation or renewal, obtain STS-signed tokens for that identity. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.12h CVE-2026-1028244.3 MED

3.1%

——1Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret, forcing the X25519 contribution to the combined shared secret to zero. A malicious SSH peer can therefore make the combined secret depend only on ML-KEM, defeating the hybrid exchange's intended fallback protection if ML-KEM is later weakened. This issue is fixed in version 0.63.0.21d