28 matches found
CVE-2026-71281
Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...
CVE-2026-71281 peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules
Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...
EUVD-2026-53366
Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...
CVE-2026-71281 peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules
Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...
CVE-2026-71281
Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...
CVE-2026-71281
The CVE-2026-71281 details a vulnerability in Hugging Face PEFT: LoRA-GA and CorDA initialization modules call torch.load() on cache/covariance files without weights_only=True, bypassing PEFT’s safe-loading wrapper. This full pickle deserialization can lead to arbitrary code execution if a malici...
CVE-2026-71281 peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules
Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...
CVE-2026-71281: Deserialization of Untrusted Data
Hugging Face peft's LoRA-GA and CorDA initialization modules src/peft/tuners/lora/corda.py lines 102 and 163, and src/peft/tuners/lora/loraga.py line 101 call torch.load on config-specified cache/covariance files without weightsonly=True, bypassing peft's own safe-loading wrapper used elsewhere i...
EUVD-2019-11504
Malware in sbrugna...
Malicious code in @zalastax/nolb-corda (npm)
The package @zalastax/nolb-corda was found to contain malicious code...
MAL-2025-11005 Malicious code in @zalastax/nolb-corda (npm)
The package @zalastax/nolb-corda was found to contain malicious code...
CVE-2019-25057
In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer...
CVE-2019-25057
In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer...
CVE-2019-25057
In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer...
Code injection
In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer...
CVE-2019-25057
In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer...
CVE-2019-25057
In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer...
CVE-2019-25057
This CVE affects R3 Corda prior to version 4.1. The issue arises because the meaning of serialized data can be modified by an attacker-controlled CustomSerializer , enabling data manipulation at the serialization layer. The vulnerability pertains to the integrity of serialized data (per CVSS), wi...
R3 Corda 安全漏洞
R3 Corda is an open source blockchain platform from R3 Corporation in the United States. A security vulnerability exists in versions of R3 Corda prior to 4.1, which can be exploited by an attacker to modify the meaning of serialized data via a controlled CustomSerializer...
PT-2022-8281
Name of the Vulnerable Software and Affected Versions Corda versions prior to 4.1 Description The issue allows an attacker to modify the meaning of serialized data using a CustomSerializer under their control. Recommendations For versions prior to 4.1, update to version 4.1 or later to resolve th...