CVE-2026-71281

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

CVE-2026-71281 peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

CVE-2026-71281

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

EUVD-2026-53366

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

CVE-2026-71281 peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

CVE-2026-71281

The CVE-2026-71281 details a vulnerability in Hugging Face PEFT: LoRA-GA and CorDA initialization modules call torch.load() on cache/covariance files without weights_only=True, bypassing PEFT’s safe-loading wrapper. This full pickle deserialization can lead to arbitrary code execution if a malici...

CVE-2026-71281 peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

CVE-2026-71281: Deserialization of Untrusted Data

Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...

EUVD-2019-11504

Malware in sbrugna...

Malicious code in @zalastax/nolb-corda (npm)

The package @zalastax/nolb-corda was found to contain malicious code...

MAL-2025-11005 Malicious code in @zalastax/nolb-corda (npm)

The package @zalastax/nolb-corda was found to contain malicious code...

CVE-2019-25057

In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer...

CVE-2019-25057

In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer...

CVE-2019-25057

In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer...

Code injection

In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer...

CVE-2019-25057

In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer...

CVE-2019-25057

This CVE affects R3 Corda prior to version 4.1. The issue arises because the meaning of serialized data can be modified by an attacker-controlled CustomSerializer , enabling data manipulation at the serialization layer. The vulnerability pertains to the integrity of serialized data (per CVSS), wi...

R3 Corda 安全漏洞

R3 Corda is an open source blockchain platform from R3 Corporation in the United States. A security vulnerability exists in versions of R3 Corda prior to 4.1, which can be exploited by an attacker to modify the meaning of serialized data via a controlled CustomSerializer...

CVE-2019-25057: Undefined Security Weakness

In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer...

U.S. Dept Of Defense: Corda Server XSS ████████

Summary: Cord server will display the error message if something isn't allowed to be used thus allowing xss Description: /scripts/ctredirector.dll allows users to call images or files. We can use the parameter @FILE to dictate a file or url, if it fails it'll display the url into the page. We the...