PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

PYSEC-2026-3974 Remote code execution in pytorch lightning

A remote code execution RCE vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. The library uses deepdiff.Delta objects to modify application state base...

PYSEC-2026-3968

pytorch-lightning is vulnerable to Deserialization of Untrusted Data...

Remote code execution in pytorch lightning

A remote code execution RCE vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. The library uses deepdiff.Delta objects to modify application state base...

PYSEC-2026-3968

pytorch-lightning is vulnerable to Deserialization of Untrusted Data...

PYSEC-2026-3972 PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

artemis-core-client: activemq-artemis: Unsafe deserialization via JsonUtil CompositeData on management address

A flaw was found in Apache ActiveMQ Artemis. The JsonUtil.fromJsonArray method uses ObjectInputStream.readObject to deserialize CompositeData from Base64-encoded serialized objects in management message bodies sent to the activemq.management address. While the deserialization is protected by an...

Security Bulletin: IBM Terracotta is affected by jackson-databind vulnerabilities that could allow attackers to bypass validation mechanisms, trigger unauthorized DNS queries, or overwrite ignored property filters

Summary IBM Terracotta uses jackson-databind for convert Java objects to JSON serialization and JSON data back into Java objects deserialization within the product. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and...

CVE-2026-88049

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize in src/lstm/networkio.cpp but left NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart unchecked. In...

CVE-2026-88049 Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatch

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize in src/lstm/networkio.cpp but left NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart unchecked. In...

CVE-2026-88048

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni and no against the weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVector in...

EUVD-2026-75591

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni and no against the weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVector in...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Citrix Netscaler_Application_Delivery_Controller

Citrix NetScaler SAML nFactor Context Authentication Bypass —...

CVE-2026-87962

A flaw was found in t-digest. A remote attacker could exploit a denial of service vulnerability in the MergingDigest.fromBytes function by providing specially crafted serialized data. This data, with unvalidated length and capacity fields, can cause the parsing thread to abort due to an...

CVE-2026-87962

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or...

EUVD-2026-75387

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or...

PYSEC-2026-3867 NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft...

PyOD persistence.load deserializes untrusted artifacts before validation

A vulnerability was detected in yzhao062 pyod 3.5.0/3.5.1/3.5.2. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The pull request to fix thi...

PYSEC-2026-3909 PyOD persistence.load deserializes untrusted artifacts before validation

A vulnerability was detected in yzhao062 pyod 3.5.0/3.5.1/3.5.2. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The pull request to fix thi...

CVE-2026-82925

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...