CVE-2026-15605
A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The pull request to fix this issue awaits acceptance.
Scoring
- Severity
- LOW
- CVSS base score
- 3.1
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
- EPSS probability
- 0.23%
- CWE
- CWE-328, CWE-327
- Published
- 2026-07-13
- Last modified
- 2026-07-14
Affected products
- n/a wandb
Weakness type
Related vulnerabilities
- CVE-2026-41879 — Weak password hashing in R-SOFT DMS
- CVE-2026-14742 — langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash
- CVE-2026-14738 — exo-explore exo Vision Feature Cache vision.py _image_cache_key weak hash
- CVE-2026-14630 — ForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hash
- CVE-2026-10540 — Weak password hash protection in Control-M/Entreprise Manager
- CVE-2026-13455 — PostgreSQL Anonymizer: Unrestricted function can leak the secret salt
- CVE-2026-53692 — Weak hashing algorithm in Redeight CMS
- CVE-2026-13510 — SimStudioAI sim Password Protection deployment.ts weak hash