CVE-2025-2953: Improper Resource Shutdown or Release

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnnmaxpool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be...

CBL Mariner 2.0 Security Update: pytorch (CVE-2024-31580)

The version of pytorch installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-31580 advisory. - PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component...

Pytorch-Lightning Code Issue Vulnerability

Pytorch-Lightning is an open source lightweight PyTorch wrapper from Lightning AI open source in the US. Used for high performance Ai research. Pytorch-Lightning suffers from a code issue vulnerability that stems from the application's lack of effective validation of uploaded files. An attacker c...

Security Bulletin: IBM Maximo Application Suite Ai-Broker Component vulnerable to PyTorch to execute arbitrary code on the system.

Summary Security Bulletin: IBM Maximo Application Suite Ai-Broker Component may be vulnerable to PyTorch arbitrary code execution of Python code through the use of torch. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-48063...

CVE-2024-6577

In the latest version of pytorch/serve, the script 'uploadresultstos3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not...

CVE-2024-7804

A flaw was found in PyTorch. This vulnerability allows an attacker to execute arbitrary code remotely via a maliciously crafted serialized PythonUDF object. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security...

CVE-2024-8019

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

CVE-2024-8020

A flaw was found in PyTorch Lightning. This vulnerability allows an attacker to cause a denial of service via an unexpected POST request to the /api/v1/state endpoint, leading to improper handling of state values and server shutdown. Mitigation Implementing an input validation on the server-side...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2025-1474 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2025-0453 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2025-0453 Source advisory: OSV:GHSA-49M6-VRR9-2CQM...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2024-8859 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2024-8859 Source advisory: OSV:GHSA-4RQF-8PFM-P36R...

pylaia (>=1.1.0, <=1.1.1rc1), pyrovelocity (0.1.1) +2 more potentially affected by CVE-2024-8020 via pytorch-lightning (1.3.0)

pytorch-lightning PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pylaia =1.1.0, =1.1.1rc1 - pyrovelocity 0.1.1 - ratsnlp 0.0.9984 - ride 0.4.4 Source cves: CVE-2024-8020 Source advisory:...

anomalib (>=0.4.0rc2, <=1.0.0.dev0), ast-slizovskaia (>=0.1.1, <=0.1.4) +150 more potentially affected by CVE-2024-8020 via pytorch-lightning (1.9.5)

pytorch-lightning PYPI version 1.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - anomalib =0.4.0rc2, =0.1.1, =0.1.0, =0.3.2b20220218, =0.6.3b20230121, =0.6.3b20230210, =0.5.62, =0.1.3, =3.3.0, =0.0.1, =0.1.0...

adversarial-insight-ml (0.1.0), aihandler (>=1.8.15, <=1.8.20) +99 more potentially affected by CVE-2024-8020 via pytorch-lightning (>=2.0.0rc0, <=2.3.0)

pytorch-lightning PYPI version =2.0.0rc0, =1.8.15, =1.8.17, =1.8.14, =0.8.3b20230817, =0.8.3b20230802, =0.1.1, =0.1.0, =0.9.0, =0.0.15, =0.3.0, =0.4.5 - chatairunner 1.0.10 and more Source cves: CVE-2024-8020 Source advisory: OSV:GHSA-98FP-7V67-4V3Q...

adversarial-insight-ml (0.1.0), aihandler (>=1.8.15, <=1.8.20) +99 more potentially affected by CVE-2024-8020 via pytorch-lightning (>=2.0.0rc0, <=2.3.0)

pytorch-lightning PYPI version =2.0.0rc0, =1.8.15, =1.8.17, =1.8.14, =0.8.3b20230817, =0.8.3b20230802, =0.1.1, =0.1.0, =0.9.0, =0.0.15, =0.3.0, =0.4.5 - chatairunner 1.0.10 and more Source cves: CVE-2024-8020 Source advisory: GHSA-98FP-7V67-4V3Q...

finetuning-scheduler (0.1.2), gts-engine (>=0.1.1, <=0.1.2) +3 more potentially affected by CVE-2024-8020 via pytorch-lightning (1.6.2)

pytorch-lightning PYPI version 1.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - finetuning-scheduler 0.1.2 - gts-engine =0.1.1, =0.3.3, =0.1.0, =0.1.5 Source cves: CVE-2024-8020 Source advisory:...

finetuning-scheduler (>=0.1.3, <=0.1.4), mridc (0.1.0) +3 more potentially affected by CVE-2024-8020 via pytorch-lightning (1.6.3)

pytorch-lightning PYPI version 1.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - finetuning-scheduler =0.1.3, =0.1.0, =0.1.2 - vocalforge 0.0.4 Source cves: CVE-2024-8020 Source advisory:...

autogluon (>=0.4.1b20220511, <=0.5.3b20221005), autogluon-multimodal (>=0.4.3b20220616, <=0.5.3b20221005) +38 more potentially affected by CVE-2024-8020 via pytorch-lightning (1.6.5.post0)

pytorch-lightning PYPI version 1.6.5.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - autogluon =0.4.1b20220511, =0.4.3b20220616, =0.4.1b20220511, =1.0.0, =0.1.3, =0.5.33, =0.1.5, =0.6.0, =0.6.1, =0.47.0,...

dimweb-persona-bot (0.0.6), finetuning-scheduler (0.2.2) +1 more potentially affected by CVE-2024-8020 via pytorch-lightning (1.7.6)

pytorch-lightning PYPI version 1.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - dimweb-persona-bot 0.0.6 - finetuning-scheduler 0.2.2 - gts-engine 0.1.3 Source cves: CVE-2024-8020 Source advisory:...

mofreinforce (>=0.0.2, <=1.0.1) potentially affected by CVE-2024-8020 via pytorch-lightning (1.8.0)

pytorch-lightning PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - mofreinforce =0.0.2, =1.0.1 Source cves: CVE-2024-8020 Source advisory: OSV:GHSA-98FP-7V67-4V3Q...