CVE-2025-46149

In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error...

CVE-2025-46153

PyTorch before 3.7.0 has a bernoullip decompose function in decompositions.py even though it lacks full consistency with the eager CPU implementation, negatively affecting nn.Dropout1d, nn.Dropout2d, and nn.Dropout3d for fallbackrandom=True...

PT-2025-39415

Name of the Vulnerable Software and Affected Versions pytorch version 2.7.0 Description A Name Error occurs when a PyTorch model includes torch.cummin and is compiled by Inductor, resulting in a Denial of Service DoS. The issue involves a naming conflict during the compilation process, leading to...

CVE-2025-46152

In PyTorch before 2.7.0, bitwiserightshift produces incorrect output for certain out-of-bounds values of the "other" argument...

CVE-2025-46152

In PyTorch before 2.7.0, bitwiserightshift produces incorrect output for certain out-of-bounds values of the "other" argument...

CVE-2025-55560

CVE-2025-55560 affects PyTorch where a model using torch.Tensor.to_sparse() and torch.Tensor.to_dense() compiled by Inductor can cause a DoS. Connected advisories specify affected package versions: PyTorch < 2.0.0-11 and PyTorch

PT-2025-39381

Name of the Vulnerable Software and Affected Versions PyTorch versions prior to 2.7.0 Description When torch.compile is used, the FractionalMaxPool2d function exhibits inconsistent results. This issue affects the accuracy of computations involving this specific function within the PyTorch...

CVE-2025-55552

CVE-2025-55552 concerns PyTorch v2.8.0 exhibiting unexpected behavior when using torch.rot90 and torch.randn_like together. The primary sources state the issue exists in PyTorch 2.8.0 and provide no explicit remediation in the initial description. Some connected advisories note that patched versi...

CVE-2025-55554

pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nantonum-.long...

CVE-2025-55553

A syntax error in the component proxytensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service DoS...

CVE-2025-46153

PyTorch before 3.7.0 has a bernoullip decompose function in decompositions.py even though it lacks full consistency with the eager CPU implementation, negatively affecting nn.Dropout1d, nn.Dropout2d, and nn.Dropout3d for fallbackrandom=True...

CVE-2025-46149

CVE-2025-46149 is linked to PyTorch, affecting versions before 2.7.0. When using inductor, nn.Fold triggers an assertion error, per the IBM security bulletin listing this CVE among multiple PyTorch-related issues. The IBM entry provides the concrete detail that the vulnerability manifests as an a...

CVE-2025-55558

A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv and is compiled by Inductor, leading to a Denial of Service DoS...

CVE-2025-46150

In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results...

CVE-2025-46149

In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error...

CVE-2025-46150

In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results...

Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses PyTorch which is vulnerable to CVE-2025-4287

Summary Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses PyTorch which is vulnerable to CVE-2025-4287. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-4287 DESCRIPTION: A vulnerability was found in PyTor...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in torch-2.6.0-cp313-cp313-manylinux1_x86_64.whl

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of torch-2.6.0-cp313-cp313-manylinux1x8664.whl Vulnerability Details CVEID:CVE-2025-3000 DESCRIPTION: A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The...

CVE-2025-10155

An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass pickle files security checks by supplying a standard pickle file with a PyTorch-related file extension. When the pickle file incorrectly...

GHSA-J424-MC44-F4HJ Duplicate Advisory: Picklescan Bypass is Possible via File Extension Mismatch

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jgw4-cr84-mqxg. This link is maintained to preserve external references. Original Description An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and includin...