CVE-2024-3660-PoC

CVE-2024-3660 – Ejecución de código arbitrario en TensorFlow Keras mediante modelo malicioso Resumen CVE-2024-3660 es una vulnerabilidad de ejecución de código arbitrario en el framework Keras de TensorFlow que afecta a las versiones \ --build-arg LPORT= \ -t tfimg . && \ containerid=$docker crea...

CVE-2026-0596-Reproduction

CVE-2026-0596: Ejecución de Código Arbitrario mediante Deserialización Insegura en el Ecosistema MLflow Un informe de investigación de seguridad exhaustivo que detalla la verificación, los mecanismos subyacentes y las vulnerabilidades arquitectónicas asociadas con los pipelines de carga de modelo...

CVE-2025-32434

CVE-2025-32434: PyTorch RCE Vulnerability - PoC What is CVE-2025-32434? CVE-2025-32434 is a critical Remote Code Execution RCE vulnerability in PyTorch, a widely used Python library for deep learning and neural networks. The Core Problem The vulnerability exists in the torch.load function, even...

CVE-2026-47117-openmed-rce

CVE-2026-47117: OpenMed Unauthenticated Remote Code Execution via PII Model Loading Severity: Critical, CVSS 4.0 9.3 , CVSS 3.1 9.8 assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...

CVE-2026-22807_Range

🛡️ CVE-2026-22807 Simulation: AI Supply Chain RCE Target Range ⚠️ Disclaimer This project is intended solely for security research and educational purposes , aiming to demonstrate the supply chain attack principle Remote Code Execution during AI model loading. Do not use the generated malicious...

CVE-2026-54559

PocketSphinx (a lightweight speech recognizer, including its Python bindings) versions 5prealpha through 5.1.0 are affected by buffer overflow vulnerabilities in its model-loading code. The trie language-model loaders in src/lm/ngram_model_trie.c fail to validate boundary conditions in ARPA, DMP,...

CVE-2026-54559 PocketSphinx: Buffer overflows in language and acoustic model loading code

PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in src/lm/ngrammodeltrie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format headers, and the acoustic-model loaders in src/mdef.c and src/util/bio.c use sscanf with unbounded...

CVE-2026-54559 PocketSphinx: Buffer overflows in language and acoustic model loading code

PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in src/lm/ngrammodeltrie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format headers, and the acoustic-model loaders in src/mdef.c and src/util/bio.c use sscanf with unbounded...

CVE-2026-55832 Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled externaldata location from an ONNX model through onnx/src/tensor.rs getexternalresources and joins the value to the model...

CVE-2026-90553

A flaw was found in vLLM. The LlavaOnevision2 processor loader incorrectly ignores the trustremotecode parameter, which is designed to prevent the execution of untrusted code. This oversight allows an attacker to craft a malicious model containing arbitrary code. When such a model is loaded, the...

CVE-2026-90553

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader . The loader ignores the trust_remote_code parameter when loading remote processor classes, allowing an attacker to craft a malicious model with arbitrary code in processing_llava_onevision2....

CVE-2026-90553 vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trustremotecode parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processingllavaonevision2.py that executes with...

CVE-2026-88054

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A remote attacker could provide a specially crafted '.traineddata' model with a zero-length stack for certain internal layers. This would cause an empty-stack dereference during model loading, leading to a...

CVE-2026-88054

Tesseract is an open-source OCR engine affected in version 5.5.3 and earlier by a denial-of-service flaw. The root cause is in Plumbing::DeSerialize (src/lstm/plumbing.cpp), which rejects excessively large network stacks but accepts a zero-length stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED l...

PYSEC-2026-3856 Keras model loading is vulnerable to denial of service through HDF5 shape bombs

A vulnerability in keras-team/keras versions 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in keras/src/saving/savinglib.py does not validate the shape or size of datasets, leading t...

Keras model loading is vulnerable to denial of service through HDF5 shape bombs

A vulnerability in keras-team/keras versions 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in keras/src/saving/savinglib.py does not validate the shape or size of datasets, leading t...

CVE-2026-86169

Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository...

Duplicate Advisory: Allowlisted pickle loaders still permit code execution in current source

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x99w-6fgc-pmfw. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust...

PYSEC-2026-3735

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer.execute and...

CVE-2026-79657

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer.execute and...