pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2025-15379 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2025-15379 Source advisory: OSV:PYSEC-2026-423...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2023-6975 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2023-6975 Source advisory: OSV:PYSEC-2026-422...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2023-6974 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2023-6974 Source advisory: OSV:PYSEC-2026-416...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2023-6015 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2023-6015 Source advisory: OSV:PYSEC-2026-420...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2023-6014 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2023-6014 Source advisory: OSV:PYSEC-2026-415...

PYSEC-2026-386 pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the pluginserver, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path...

PYSEC-2026-385 Remote code execution in pytorch lightning

A remote code execution RCE vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. The library uses deepdiff.Delta objects to modify application state base...

pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the pluginserver, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path...

Remote code execution in pytorch lightning

A remote code execution RCE vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. The library uses deepdiff.Delta objects to modify application state base...

optimuspyspark (>=2.0.4, <=2.0.6), pytorch-es (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2023-25668 via tensorflow (1.6.0)

tensorflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - optimuspyspark =2.0.4, =0.1.0, =0.12.0, =0.7.2, =0.10.0 Source cves: CVE-2023-25668 Source advisory: OSV:PYSEC-2026-548...

medical-data (0.2.0.dev0), ptlflow (>=0.3.0, <=0.3.2) +4 more potentially affected by CVE-2024-5980 via lightning (1.9.5)

lightning PYPI version 1.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on lightning and may be impacted: - medical-data 0.2.0.dev0 - ptlflow =0.3.0, =0.0.1, =0.1.0, =0.2.13, =0.3.3 Source cves: CVE-2024-5980 Source advisory: OSV:PYSEC-2026-386...

medical-data (0.2.0.dev0), ptlflow (>=0.3.0, <=0.3.2) +4 more potentially affected by CVE-2024-5452 via lightning (1.9.5)

lightning PYPI version 1.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on lightning and may be impacted: - medical-data 0.2.0.dev0 - ptlflow =0.3.0, =0.0.1, =0.1.0, =0.2.13, =0.3.3 Source cves: CVE-2024-5452 Source advisory: OSV:PYSEC-2026-385...

classy-core (0.1.0a0), iqradre (>=0.1.5, <=0.2.1) +2 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.4.5)

pytorch-lightning PYPI version 1.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - classy-core 0.1.0a0 - iqradre =0.1.5, =1.0.0, =1.1.1 - torchility 0.2.10 Source cves: CVE-2024-8019 Source advisory:...

mimikit (>=0.1.0, <=0.1.10), pytorch-hyperlight (0.1.3) potentially affected by CVE-2024-8019 via pytorch-lightning (1.1.2)

pytorch-lightning PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - mimikit =0.1.0, =0.1.10 - pytorch-hyperlight 0.1.3 Source cves: CVE-2024-8019 Source advisory: OSV:PYSEC-2026-507...

benchformer (0.0.1.dev1), nerblackbox (>=0.0.5, <=0.0.10) +1 more potentially affected by CVE-2024-8019 via pytorch-lightning (0.7.1)

pytorch-lightning PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - benchformer 0.0.1.dev1 - nerblackbox =0.0.5, =0.0.10 - nlp-architect 0.5.3 Source cves: CVE-2024-8019 Source advisory:...

admetica (>=1.3.0, <=1.4.1), adversarial-insight-ml (0.1.0) +134 more potentially affected by CVE-2024-8019 via pytorch-lightning (>=2.0.0rc0, <=2.3.3)

pytorch-lightning PYPI version =2.0.0rc0, =1.3.0, =1.8.15, =1.8.17, =1.8.14, =1.0.0rc1, =0.8.3b20230817, =0.8.3b20230802, =0.1.1, =0.1.0, =0.9.0, =0.9.3 and more Source cves: CVE-2024-8019 Source advisory: OSV:PYSEC-2026-507...

PYSEC-2026-507 PyTorch Lightning path traversal vulnerability

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

anomalib (>=0.2.2, <=0.2.4), wildtime (>=1.0.0, <=1.1.3) potentially affected by CVE-2024-8019 via pytorch-lightning (1.3.6)

pytorch-lightning PYPI version 1.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - anomalib =0.2.2, =1.0.0, =1.1.3 Source cves: CVE-2024-8019 Source advisory: OSV:PYSEC-2026-507...

route-distances (>=1.2.0, <=1.2.4) potentially affected by CVE-2024-8019 via pytorch-lightning (1.8.3.post2)

pytorch-lightning PYPI version 1.8.3.post2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - route-distances =1.2.0, =1.2.4 Source cves: CVE-2024-8019 Source advisory: OSV:PYSEC-2026-507...

simple-leftrefill-inpainting (0.0.1), tldream (>=0.1.0, <=0.4.1) potentially affected by CVE-2024-8019 via pytorch-lightning (1.5.0)

pytorch-lightning PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - simple-leftrefill-inpainting 0.0.1 - tldream =0.1.0, =0.4.1 Source cves: CVE-2024-8019 Source advisory: OSV:PYSEC-2026-507...