ratsnlp (>=0.0.9981, <=1.0.51) potentially affected by CVE-2026-31221 via pytorch-lightning (1.3.4)

pytorch-lightning PYPI version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - ratsnlp =0.0.9981, =1.0.51 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

EUVD-2026-29511

The Adversarial Robustness Toolbox ART thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow component. The robustness evaluation function for PyTorch models uses the unsafe eval function to dynamically evaluate user-supplied strings for the LossFn and Optimizer parameters...

code2seq (>=0.0.0, <=0.0.4), disent (>=0.0.1.dev1, <=0.0.1.dev11) +3 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.1.7)

pytorch-lightning PYPI version 1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - code2seq =0.0.0, =0.0.1.dev1, =0.3.0.0, =0.0.0.4, =0.0.0.8 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJP...

chemprobe (0.1.1), dlk (>=0.0.6, <=0.0.10) potentially affected by CVE-2026-31221 via pytorch-lightning (1.5.8)

pytorch-lightning PYPI version 1.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - chemprobe 0.1.1 - dlk =0.0.6, =0.0.10 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

axlnlp (0.0.1) potentially affected by CVE-2026-31221 via pytorch-lightning (0.7.3)

pytorch-lightning PYPI version 0.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - axlnlp 0.0.1 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

moai-mdk (>=0.1.0a1, <=0.1.0a2) potentially affected by CVE-2026-31221 via pytorch-lightning (1.0.7)

pytorch-lightning PYPI version 1.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - moai-mdk =0.1.0a1, =0.1.0a2 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

cookiellmtest (>=1.0.1, <=1.0.6), cookienlp (>=1.0.0, <=1.0.2) +3 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.6.1)

pytorch-lightning PYPI version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - cookiellmtest =1.0.1, =1.0.0, =1.0.52, =1.0.53 - smallteacher 0.0.1 Source cves: CVE-2026-31221 Source advisory:...

argos-trains (0.1.0), fastmri (>=0.1.0.post210716, <=0.1.1) +5 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.0.8)

pytorch-lightning PYPI version 1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - argos-trains 0.1.0 - fastmri =0.1.0.post210716, =0.5.1, =0.5.3 - quickvision 0.1.1rc1 - raylab 0.14.12 Source cves:...

nemo-toolkit (1.1.0) potentially affected by CVE-2026-31221 via pytorch-lightning (1.3.7.post0)

pytorch-lightning PYPI version 1.3.7.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - nemo-toolkit 1.1.0 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

ratsnlp (>=0.0.971, <=0.0.997) potentially affected by CVE-2026-31221 via pytorch-lightning (1.2.3)

pytorch-lightning PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - ratsnlp =0.0.971, =0.0.997 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

backprop (>=0.0.1, <=0.0.2), kiri (>=0.5.0.dev1, <=0.5.1) +3 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.1.0)

pytorch-lightning PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - backprop =0.0.1, =0.5.0.dev1, =1.0.2, =0.1.1rc3, =0.1.1 - ragcar 0.1.0 Source cves: CVE-2026-31221 Source advisory:...

EUVD-2026-29503

The loadmodel function in the neuralmagictraining.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f 2024-07-21 is vulnerable to insecure deserialization CWE-502. When a user provides a single model file path e.g., .pt or .pth via the --model command-line argumen...

GHSA-75M9-98V2-HJPM PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

nemo-toolkit (1.0.0rc1) potentially affected by CVE-2026-31221 via pytorch-lightning (1.1.5)

pytorch-lightning PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - nemo-toolkit 1.0.0rc1 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

admetica (>=1.3.0, <=1.4.1), adversarial-insight-ml (0.1.0) +181 more potentially affected by CVE-2026-31221 via pytorch-lightning (>=2.0.0rc0, <=2.6.0)

pytorch-lightning PYPI version =2.0.0rc0, =1.3.0, =1.8.15, =1.8.17, =1.8.14, =1.0.0, =0.9.2, =1.0.0rc1, =0.8.3b20230817, =0.8.3b20230802, =0.1.1, =0.2.2 and more Source cves: CVE-2026-31221 Source advisory: GHSA-75M9-98V2-HJPM...

PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

autogluon-timeseries (>=0.6.3b20230121, <=0.6.3b20230209), contra-il6 (>=1.0.1, <=1.0.4) +17 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.8.6)

pytorch-lightning PYPI version 1.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - autogluon-timeseries =0.6.3b20230121, =1.0.1, =1.2.5, =1.3.2, =0.2.0, =0.1.2, =4.0.0rc0, =1.2.43, =1.0.0, =0.1.0, =0.2.1 -...

deep-learning-plus (>=0.0.5, <=0.0.7), torchfl (>=0.1.1, <=0.1.5) potentially affected by CVE-2026-31221 via pytorch-lightning (1.5.7)

pytorch-lightning PYPI version 1.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - deep-learning-plus =0.0.5, =0.1.1, =0.1.5 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

pytorch-segmentation-models-trainer (0.15.0) potentially affected by CVE-2026-31221 via pytorch-lightning (1.5.2)

pytorch-lightning PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.15.0 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

admetica (>=1.3.0, <=1.4.1), adversarial-insight-ml (0.1.0) +181 more potentially affected by CVE-2026-31221 via pytorch-lightning (>=2.0.0rc0, <=2.6.0)

pytorch-lightning PYPI version =2.0.0rc0, =1.3.0, =1.8.15, =1.8.17, =1.8.14, =1.0.0, =0.9.2, =1.0.0rc1, =0.8.3b20230817, =0.8.3b20230802, =0.1.1, =0.2.2 and more Source cves: CVE-2026-31221 Source advisory: SNYK:PYTHON-PYTORCHLIGHTNING-16643334...