{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:34.065Z","products":["xorbitsai"],"actNowTotal":0,"results":[{"query":"xorbitsai","matched":1,"actNow":0,"events":[{"id":"early-cve-2026-49950","url":"https://securitythreatpulse.com/events/early-cve-2026-49950","title":"Xorbitsai Xoscar: attackers can run their own code","verdict":"watch","verdictReason":"One source reports attacks and the vulnerability is 28 days old. In our backtest a single early report was confirmed within 30 days about one time in twenty, so we wait for a second report or for attack attempts to be seen.","tier":null,"rankScore":3,"rankWhy":["Exploitation is reported.","The first report is 7 days old."],"rulesVersion":"v3","ladder":{"talk":"none","damage":"none","attempts":"reported","exposure":"none","exploited":"reported"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-49950"],"vendor":"xorbitsai","product":"xoscar","affectedProducts":[{"kind":"direct","slug":"xorbitsai/xoscar","vendor":"Xorbitsai","product":"Xoscar","evidence":["cna","cpe"],"vendorKey":"xorbitsai","productKey":"xoscar"}],"category":{"id":"other","label":"Other software","why":"Software we have not put in a category yet. Your IT team or provider will know whether you run it.","doThis":"Find out if you use it. If you do, apply the vendor's fix."},"summary":"Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel.","cvss":9.3,"epss":0.0085,"exploitMaturity":"none","kevListed":false,"kevDateAdded":null,"kevDueDate":null,"firstSeenAt":"2026-11-04T16:07:28.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-04T16:07:28.000Z"}]}]}