CVE-2026-47749: Out-of-bounds Write

stable-diffusion.cpp is a pure C/C++ library for running diffusion model Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more inference. Versions prior to master-584-0a7ae07 are vulnerable to heap buffer overflow in SHORTBINUNICODE parsing for PyTorch checkpoint files. The pickle .ckpt pars...

CVE-2026-47748: Out-of-bounds Read

stable-diffusion.cpp is a pure C/C++ library for running diffusion model Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more inference. Versions prior to master-584-0a7ae07 are vulnerable to an out-of-bounds reads error through PyTorch checkpoint pickle opcode parsing. The pickle .ckpt...

Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. Python is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak as part of its deployment. This bulletin identifies the fixes...

CVE-2026-31228

A flaw was found in the Adversarial Robustness Toolbox ART, specifically within its Kubeflow component. The robustness evaluation function for PyTorch models uses the eval function to dynamically evaluate user-supplied strings for the LossFn and Optimizer parameters without proper sanitization. A...

CVE-2026-31239

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2026-4035 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2026-4035 Source advisory: OSV:GHSA-G35P-PX32-WHV6...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-4035 via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-4035 Source advisory: OSV:GHSA-G35P-PX32-WHV6...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-4035 via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-4035 Source advisory: OSV:PYSEC-2026-2222...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-3198 via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-3198 Source advisory: OSV:GHSA-R5M9-WM49-959F...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2026-3198 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2026-3198 Source advisory: OSV:GHSA-R5M9-WM49-959F...

PT-2026-45457

An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load with unrestricted deserialization...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2026-2651 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2026-2651 Source advisory: OSV:GHSA-8C7Q-86FQ-VVMH...

CVE-2025-51480 affecting package pytorch for versions less than 2.2.2-15

CVE-2025-51480 affecting package pytorch for versions less than 2.2.2-15. A patched version of the package is available...

CVE-2026-31218

The loadmodel function in the neuralmagictraining.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f 2024-07-21 is vulnerable to insecure deserialization CWE-502. When loading a model state dictionary from a statedict.pt file via torch.load, the function does not...

CVE-2026-44484

A flaw was found in PyTorch Lightning. This deep learning framework introduced functionality that could be leveraged as a credential harvesting mechanism. A remote attacker could exploit this to obtain sensitive user credentials, leading to significant information disclosure and potential further...

llm-foundry (>=0.9.1, <=0.10.0), mlflow-pytorch-exp (0.0.1) potentially affected by CVE-2026-2652 via mlflow (2.14.3)

mlflow PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - llm-foundry =0.9.1, =0.10.0 - mlflow-pytorch-exp 0.0.1 Source cves: CVE-2026-2652 Source advisory: OSV:GHSA-75CM-X2W3-8MGF...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2026-2652 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2026-2652 Source advisory: OSV:GHSA-75CM-X2W3-8MGF...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2026-2652 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2026-2652 Source advisory: OSV:PYSEC-2026-2221...

CVE-2026-44484

PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism...

CVE-2026-44484

PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism...