PT-2026-59684

A security vulnerability has been detected in SGLang 0.5.10.post1. Impacted is an unknown function of the file python/sglang/srt/lora/lora manager.py of the component Inference HTTP Endpoint. Such manipulation of the argument lora path leads to reachable assertion. The attack can be launched...

Securing LLMs in the Wild: Privacy and Security Challenges at the Edge

Large Language Models LLMs are rapidly moving from research settings into the wild, deployed on enterprise infrastructure, personal devices, and edge platforms. While cloud deployments offer scalable compute, concerns over data sovereignty, compliance, latency, and third-party dependence are...

SoK: Federated Learning for Intrusion Detection in Vehicular Networks

Modern vehicular networks face an expanding attack surface across internal Electronic Control Units ECUs and external Vehicle-to-Everything V2X communication. Federated Learning FL has emerged as a decentralized paradigm to deploy Intrusion Detection Systems IDS without compromising data privacy...

blrec (>=1.8.0a3, <=2.0.0b5), dagster-looker (>=0.26.6rc0, <=0.29.21) +7 more potentially affected by CVE-2026-55865 via python-liquid (>=1.9.4, <=2.2.0)

python-liquid PYPI version =1.9.4, =1.8.0a3, =0.26.6rc0, =0.8.0, =0.1.1, =0.1.0, =0.1.0, =0.4.0, =0.0.1, =1.8.0, =1.28.4 Source cves: CVE-2026-55865 Source advisory: MEND:CVE-2026-55865...

Type confusion leading to segfault in Tensorflow

Impact The implementation of shape inference for ConcatV2 can be used to trigger a denial of service attack via a segfault caused by a type confusion:pythonimport tensorflow as [email protected] test: y = tf.rawops.ConcatV2 values=1,2,3,4,5,6, axis = 0xb500005b return ytestThe axis argument is...

PYSEC-2026-3211 Type confusion leading to segfault in Tensorflow

Impact The implementation of shape inference for ConcatV2 can be used to trigger a denial of service attack via a segfault caused by a type confusion: python import tensorflow as tf @tf.function def test: y = tf.rawops.ConcatV2 values=1,2,3,4,5,6, axis = 0xb500005b return y test The axis argument...

PYSEC-2026-3249 Out of bounds read in Tensorflow

Impact TensorFlow's type inference can cause a heap OOB read as the bounds checking is done in a DCHECK which is a no-op during production: cc if nodet.typeid != TFTUNSET int ix = inputidxi; DCHECKix nodet.argssize "input " i " should have an output " ix " but instead only has " nodet.argssize "...

Crash when type cannot be specialized in Tensorflow

ImpactUnder certain scenarios, TensorFlow can fail to specialize a type during shape inference:ccvoid InferenceContext::PreInputInit const OpDef& opdef, const std::vector& inputtensors, const std::vector& inputtensorsasshapes const auto ret = fulltype::SpecializeTypeattrs, opdef;...

PYSEC-2026-3241 Crash when type cannot be specialized in Tensorflow

Impact Under certain scenarios, TensorFlow can fail to specialize a type during shape inference: cc void InferenceContext::PreInputInit const OpDef& opdef, const std::vector& inputtensors, const std::vector& inputtensorsasshapes const auto ret = fulltype::SpecializeTypeattrs, opdef;...

Out of bounds read in Tensorflow

ImpactTensorFlow's type inference can cause a heap OOB read as the bounds checking is done in a DCHECK which is a no-op during production:ccif nodet.typeid != TFTUNSET int ix = inputidxi; DCHECKix nodet.argssize "input " i " should have an output " ix " but instead only has " nodet.argssize "...

Out of bounds read in Tensorflow

Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batchdim and can result in a heap OOB read:pythonimport tensorflow as [email protected] test: y = tf.rawops.ReverseSequence input = 'aaa','bbb', seqlengths = 1,1,1, seqdim = -10, batchdim = -10...

PYSEC-2026-3121 Out of bounds read in Tensorflow

Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batchdim and can result in a heap OOB read: python import tensorflow as tf @tf.function def test: y = tf.rawops.ReverseSequence input = 'aaa','bbb', seqlengths = 1,1,1, seqdim = -10, batchdim = -...

Abort caused by allocating a vector that is too large in Tensorflow

ImpactDuring shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user:cc const auto numdims = Valueshapedim; std::vector dims; dims.reservenumdims; Patches We have patched the issue in GitHub commit 1361fb7e29449629e1df94d44e0427ebec8c83c7.The...

PYSEC-2026-3113 Abort caused by allocating a vector that is too large in Tensorflow

Impact During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user: cc const auto numdims = Valueshapedim; std::vector dims; dims.reservenumdims; Patches We have patched the issue in GitHub commit 1361fb7e29449629e1df94d44e0427ebec8c83c7. T...

PYSEC-2026-3159 Integer overflow in Tensorflow

Impact The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness: python import tensorflow as tf input = tf.constant1,1,dtype=tf.qint32 @tf.function def test: y = tf.rawops.Dequantize input=input, minrange=1.0, maxrange=10.0, mode='MINCOMBINED',...

Integer overflow in Tensorflow

Impact The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness:pythonimport tensorflow as tfinput = tf.constant1,1,[email protected] test: y = tf.rawops.Dequantize input=input, minrange=1.0, maxrange=10.0, mode='MINCOMBINED',...

PT-2026-57030

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.6 Description YesWiki's public Bazar entry-listing APIs are subject to unauthenticated SQL injection. The issue occurs when the system processes numeric query filters; while the system escapes the filter value, it...

PT-2026-59856

Impact Under certain scenarios, TensorFlow can fail to specialize a type during shape inference: cc void InferenceContext::PreInputInit const OpDef& op def, const std::vector& input tensors, const std::vector& input tensors as shapes const auto ret = full type::SpecializeTypeattrs , op def;...

PT-2026-59864

Impact TensorFlow's type inference can cause a heap OOB read as the bounds checking is done in a DCHECK which is a no-op during production: cc if node t.type id != TFT UNSET int ix = input idxi; DCHECKix node t.args size "input " i " should have an output " ix " but instead only has " node t.args...

PT-2026-59732

Impact During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user: cc const auto num dims = Valueshape dim; std::vector dims; dims.reservenum dims; Patches We have patched the issue in GitHub commit 1361fb7e29449629e1df94d44e0427ebec8c83c7...