Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Oct 12, 2026GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands viCVE-2025-71429 · Other software · RVC-Boss · reported by VulnCheckCritical 9.3
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
- Product
- GPT-SoVITS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitizeCVE-2026-63766 · Other software · RVC-Boss · reported by VulnCheckCritical 9.3
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.
- Product
- GPT-SoVITS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 15, 2025GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI.CVE-2025-49841 · Other software · RVC-Boss · reported by GitHubHigh 8.9
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in process_ckpt.py. The SoVITS_dropdown variable takes user input and passes it to the load_sovits_new function in process_ckpt.py. In load_sovits_new, the user input, here sovits_path is used to load a model with torch.load, leading to unsafe deserialization. At time of publication, no known patched versions are available.
- Product
- GPT-SoVITS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI.CVE-2025-49840 · Other software · RVC-Boss · reported by GitHubHigh 8.9
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in inference_webui.py. The GPT_dropdown variable takes user input and passes it to the change_gpt_weights function. In change_gpt_weights, the user input, here gpt_path is used to load a model with torch.load, leading to unsafe deserialization. At time of publication, no known patched versions are available.
- Product
- GPT-SoVITS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI.CVE-2025-49839 · Other software · RVC-Boss · reported by GitHubHigh 8.9
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in bsroformer.py. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr function. In uvr, a new instance of Roformer_Loader class is created with the model_path attribute containing the aformentioned user input (here called locally model_name). Note that in this step the .ckpt extension is added to the path. In the Roformer_Loader class, the user input, here called model_path, is used to load the model on that path with torch.load, which can lead to unsafe deserialization. At time of publication, no known patched versions are available.
- Product
- GPT-SoVITS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI.CVE-2025-49838 · Other software · RVC-Boss · reported by GitHubHigh 8.9
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in vr.py AudioPreDeEcho. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr function. In uvr, a new instance of AudioPreDeEcho class is created with the model_path attribute containing the aforementioned user input (here called locally model_name). Note that in this step the .pth extension is added to the path. In the AudioPreDeEcho class, the user input, here called model_path, is used to load the model on that path with torch.load, which can lead to unsafe deserialization. At time of publication, no known patched versions are available.
- Product
- GPT-SoVITS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI.CVE-2025-49837 · Other software · RVC-Boss · reported by GitHubHigh 8.9
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in vr.py AudioPre. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr function. In uvr, a new instance of AudioPre class is created with the model_path attribute containing the aforementioned user input (here called locally model_name). Note that in this step the .pth extension is added to the path. In the AudioPre class, the user input, here called model_path, is used to load the model on that path with torch.load, which can lead to unsafe deserialization. At time of publication, no known patched versions are available.
- Product
- GPT-SoVITS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI.CVE-2025-49836 · Other software · RVC-Boss · reported by GitHubHigh 8.9
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py change_label function. path_list takes user input, which is passed to the change_label function, which concatenates the user input into a command and runs it on the server, leading to arbitrary command execution. At time of publication, no known patched versions are available.
- Product
- GPT-SoVITS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI.CVE-2025-49835 · Other software · RVC-Boss · reported by GitHubHigh 8.9
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py open_asr function. asr_inp_dir (and a number of other variables) takes user input, which is passed to the open_asr function, which concatenates the user input into a command and runs it on the server, leading to arbitrary command execution. At time of publication, no known patched versions are available.
- Product
- GPT-SoVITS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI.CVE-2025-49834 · Other software · RVC-Boss · reported by GitHubHigh 8.9
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py open_denoise function. denoise_inp_dir and denoise_opt_dir take user input, which is passed to the open_denoise function, which concatenates the user input into a command and runs it on the server, leading to arbitrary command execution. At time of publication, no known patched versions are available.
- Product
- GPT-SoVITS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI.CVE-2025-49833 · Other software · RVC-Boss · reported by GitHubHigh 8.9
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in the webui.py open_slice function. slice_opt_root and slice-inp-path takes user input, which is passed to the open_slice function, which concatenates the user input into a command and runs it on the server, leading to arbitrary command execution. At time of publication, no known patched versions are available.
- Product
- GPT-SoVITS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.