bytesep (>=0.0.1, <=0.1.1), bytesep-fancybit (0.0.8) +2 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.2.1)

pytorch-lightning PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - bytesep =0.0.1, =0.1.0, =0.0.0, =0.0.2 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

yolort (0.4.0) potentially affected by CVE-2026-31221 via pytorch-lightning (1.3.0rc1)

pytorch-lightning PYPI version 1.3.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - yolort 0.4.0 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

asteroid (>=0.1.1, <=0.2.0), torchline (>=0.2.0, <=0.2.4.3) potentially affected by CVE-2026-31221 via pytorch-lightning (0.6.0)

pytorch-lightning PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.1.1, =0.2.0, =0.2.4.3 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

axlnlp (0.0.1) potentially affected by CVE-2026-31221 via pytorch-lightning (0.7.3)

pytorch-lightning PYPI version 0.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - axlnlp 0.0.1 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

dimweb-persona-bot (0.0.6), finetuning-scheduler (0.2.2) +1 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.7.6)

pytorch-lightning PYPI version 1.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - dimweb-persona-bot 0.0.6 - finetuning-scheduler 0.2.2 - gts-engine 0.1.3 Source cves: CVE-2026-31221 Source advisory:...

classy-core (>=0.2.1.dev20220303, <=0.2.1), open-metric-learning (>=0.3.0, <=0.3.6) potentially affected by CVE-2026-31221 via pytorch-lightning (1.5.9)

pytorch-lightning PYPI version 1.5.9 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - classy-core =0.2.1.dev20220303, =0.3.0, =0.3.6 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

dataset-format-benchmark (>=0.0.11, <=0.0.12), hybrid-graph (>=0.2.0, <=0.61.0) +2 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.9.3)

pytorch-lightning PYPI version 1.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - dataset-format-benchmark =0.0.11, =0.2.0, =0.1.0, =0.1.1 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

cait (1.1.3), contextualized-ml (>=0.2.5, <=0.2.6) +4 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.9.4)

pytorch-lightning PYPI version 1.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - cait 1.1.3 - contextualized-ml =0.2.5, =0.3.0, =0.1.0, =0.2.0 Source cves: CVE-2026-31221 Source advisory:...

autogluon-timeseries (>=0.6.3b20230121, <=0.6.3b20230209), contra-il6 (>=1.0.1, <=1.0.4) +17 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.8.6)

pytorch-lightning PYPI version 1.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - autogluon-timeseries =0.6.3b20230121, =1.0.1, =1.2.5, =1.3.2, =0.2.0, =0.1.2, =4.0.0rc0, =1.2.43, =1.0.0, =0.1.0, =0.2.1 -...

route-distances (>=1.2.0, <=1.2.4) potentially affected by CVE-2026-31221 via pytorch-lightning (1.8.3.post2)

pytorch-lightning PYPI version 1.8.3.post2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - route-distances =1.2.0, =1.2.4 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

anomalib (>=0.4.0rc2, <=1.0.0.dev0), ast-slizovskaia (>=0.1.1, <=0.1.4) +149 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.9.5)

pytorch-lightning PYPI version 1.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - anomalib =0.4.0rc2, =0.1.1, =0.1.0, =0.3.2b20220218, =0.6.3b20230121, =0.6.3b20230210, =0.5.62, =0.1.3, =3.3.0, =0.0.1, =0.1.0...

autogluon (>=0.3.2b20220222, <=0.4.3b20220617), autogluon-text (>=0.3.2b20220222, <=0.4.1b20220510) +29 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.5.10.post0)

pytorch-lightning PYPI version 1.5.10.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - autogluon =0.3.2b20220222, =0.3.2b20220222, =0.3.0.dev20220423, =0.1.0, =0.0.1, =0.1.11, =0.0.2, =0.5.0, =1.0.0, =0.0.1...

PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

mimikit (>=0.1.0, <=0.1.10), pytorch-hyperlight (0.1.3) potentially affected by CVE-2026-31221 via pytorch-lightning (1.1.2)

pytorch-lightning PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - mimikit =0.1.0, =0.1.10 - pytorch-hyperlight 0.1.3 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

admetica (>=1.3.0, <=1.4.1), adversarial-insight-ml (0.1.0) +183 more potentially affected by CVE-2026-31221 via pytorch-lightning (>=2.0.0rc0, <=2.6.0)

pytorch-lightning PYPI version =2.0.0rc0, =1.3.0, =1.8.15, =1.8.17, =1.8.14, =1.0.0, =0.9.2, =1.0.0rc1, =0.8.3b20230817, =0.8.3b20230802, =0.1.1, =0.2.2 and more Source cves: CVE-2026-31221 Source advisory: SNYK:PYTHON-PYTORCHLIGHTNING-16643334...

CVE-2026-31221

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

CVE-2026-31221

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

UBUNTU-CVE-2026-31221

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

CVE-2026-31221

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

CVE-2026-31221

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() (and related checkpoint loading paths) call torch.load() without weights_only=True, allowing deserialization of ...