205 matches found
Keras: HDF5 virtual datasets can disclose local files
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the H5IOStore.verifydataset and fileeditor.py methods, which fail to check the dataset.isvirtual property of HDF5 datasets. This allows ...
adpred (1.3.2), africanwhisper (>=0.2.3, <=0.9.0) +83 more potentially affected by CVE-2026-1669 via keras (>=3.0.0, <=3.12.0)
keras PYPI version =3.0.0, =0.2.3, =0.1.2, =0.1.0, =1.3.0.dev4, =1.1.8, =1.3.3, =0.1.1, =0.1.0, =0.2.3 and more Source cves: CVE-2026-1669 Source advisory: OSV:PYSEC-2026-2546...
Keras: HDF5 virtual datasets can disclose local files
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the H5IOStore.verifydataset and fileeditor.py methods, which fail to check the dataset.isvirtual property of HDF5 datasets. This allows ...
CVE-2024-1669 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-1669 affecting package keras for versions less than 3.3.3-7
CVE-2026-1669 affecting package keras for versions less than 3.3.3-7. A patched version of the package is available...
[CWE-73] Keras — Arbitrary HDF5 File Read via Virtual Dataset Bypass of External Storage Check (CVE-2026-1669 Incomplete Fix)
Description The fix for CVE-2026-1669 in Keras's H5IOStore.verifydataset method savinglib.py:1051 is incomplete. The patch checks dataset.external to block HDF5 datasets that use external file storage, but it does not check dataset.isvirtual. HDF5 Virtual Datasets VDS — created via...
Incomplete Fix for CVE-2026-1669: HDF5 External Storage File Disclosure in Legacy H5 Loading
Description Keras 3 patched CVE-2026-1669 HDF5 External Storage File Disclosure in the new .keras and .weights.h5 loading paths by adding verifydataset to check for dataset.external in H5IOStore. However, the legacy .h5 loading path keras/src/legacy/saving/legacyh5format.py was not patched. This...
CVE-2026-1669 vulnerabilities
Vulnerabilities for packages: tensorflow-gpu-jupyter, tensorflow-cpu-jupyter...
CVE-2026-1669
creationtimestamp| type| source ---|---|--- 2026-02-18 23:10:39+00:00| seen| https://gist.github.com/alon710/c30b614b2f8b58329464819257a9bb07 2026-02-18 23:24:32+00:00| seen| https://bsky.app/profile/flarestart.bsky.social/post/3mf67yrkxzi2s 2026-07-01 18:00:21+00:00| seen|...
adpred (1.3.2), africanwhisper (>=0.2.3, <=0.9.0) +83 more potentially affected by CVE-2026-1669 via keras (>=3.0.0, <=3.12.0)
keras PYPI version =3.0.0, =0.2.3, =0.1.2, =0.1.0, =1.3.0.dev4, =1.1.8, =1.3.3, =0.1.1, =0.1.0, =0.2.3 and more Source cves: CVE-2026-1669 Source advisory: GHSA-3M4Q-JMJ6-R34Q...
CVE-2026-1669
A flaw was found in Keras. A remote attacker can exploit an arbitrary file read vulnerability in the model loading mechanism HDF5 integration by providing a specially crafted .keras model file that utilizes HDF5 external dataset references. This allows the attacker to read local files and disclos...
Linux Distros Unpatched Vulnerability : CVE-2026-1669
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Arbitrary file read in the model loading mechanism HDF5 integration in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker t...
bakaano-hydro (1.3.4), topologyx (1.1.0) potentially affected by CVE-2026-1669 via keras (>=3.13.0, <=3.13.1)
keras PYPI version =3.13.0, =3.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - bakaano-hydro 1.3.4 - topologyx 1.1.0 Source cves: CVE-2026-1669 Source advisory: SNYK:PYTHON-KERAS-15268069...
UBUNTU-CVE-2026-1669
Arbitrary file read in the model loading mechanism HDF5 integration in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references...
CVE-2026-1669
Arbitrary file read in the model loading mechanism HDF5 integration in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references...
CVE-2005-1669
Cross-site scripting XSS vulnerability in Opera 8.0 Final Build 1095 allows remote attackers to inject arbitrary web script or HTML via "javascript:" URLs when a new window or frame is opened, which allows remote attackers to bypass access restrictions and perform unauthorized actions on other...
EUVD-2013-2314
Malware in sbrugna...
EUVD-2021-1669
Malware in sbrugna...
CVE-2023-1669
The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present...