CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-18948 — A flaw was found in Feast. The system improperly deserializes user-defined funct...

·Source: NIST NVD

Updated:

Executive Summary

A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the regis

Analysis

A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulnerability can result in cross-tenant data access and lateral movement within the system. CVSS Score: 9.9. Published: 2026-08-10T21:17:21.290.

Indicators of Compromise (1)

CVE (1)
CVE-2026-18948
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 10, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Western Union gets New York nod for Intermax acquisition; still face California hurdles

Western Union has committed to maintain its store locations in New York State and cap fee increases for three years in order to head off opposition to its acquisition of rival Intermax.

Finextra
MEDIUMVulnerabilityNEW

Polygon joins BofE's Digital Pound Lab to test cross-border settlement

Polygon Labs has joined Nobo Finance and Dun & Bradstreet for phase two of the Bank of England's Digital Pound Lab, testing near-instant cross-border settlement.

Finextra
CRITICALVulnerability

NVD CRITICAL: CVE-2026-19961 — A vulnerability was detected in Edimax EW-7478APC 1.04. Affected is the function...

A vulnerability was detected in Edimax EW-7478APC 1.04. Affected is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey. Performing a manipulation of the argument selSSID results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-19961
NIST NVD