Arbitrary Code Execution

Three high-severity vulnerabilities in Hugging Face Diffusers could allow crafted model repositories to execute arbitrary code, bypassing trust_remote_code and threatening the AI supply chain.

Critical on-prem Arista VeloCloud Orchestrator vulnerability CVE-2026-16812 (CVSS 10.0) is being actively exploited, enabling OS command injection and potential arbitrary code execution.

A patched Firefox JIT vulnerability (CVE-2026-10702) can be triggered by visiting a malicious webpage, enabling arbitrary code execution in the renderer; it was also used to compromise Tor Browser and is fixed in Firefox 151.0.3.