anymodality (0.1.0), autogluon-cloud (>=0.1.1b20230324, <=0.2.1b20230929) +25 more potentially affected by CVE-2025-0508 via sagemaker (>=2.16.1, <=2.236.0)

sagemaker PYPI version =2.16.1, =0.1.1b20230324, =0.4.6, =0.1.17, =0.1.0, =0.1.1, =0.9.0, =1.0.0, =1.97.0.dev0, =2.0.0, =1.0.0, =1.0.0, =0.1.2, =0.0.9, =0.0.10 - metamaker 0.1.0 and more Source cves: CVE-2025-0508 Source advisory: OSV:PYSEC-2026-1885...

ezsmdeploy (>=0.2.8, <=0.3.1) potentially affected by CVE-2025-0508 via sagemaker (1.58.2)

sagemaker PYPI version 1.58.2 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - ezsmdeploy =0.2.8, =0.3.1 Source cves: CVE-2025-0508 Source advisory: OSV:PYSEC-2026-1885...

ezsmdeploy (>=0.2.8, <=0.3.1) potentially affected by CVE-2024-34072 via sagemaker (1.58.2)

sagemaker PYPI version 1.58.2 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - ezsmdeploy =0.2.8, =0.3.1 Source cves: CVE-2024-34072 Source advisory: OSV:PYSEC-2026-1889...

sagemaker-python-sdk Command Injection vulnerability

ImpactThe capturedependencies function in sagemaker.serve.saveretrive.version100.save.utils module before version 2.214.3 allows for potentially unsafe Operating System OS Command Injection if inappropriate command is passed as the “requirementspath” parameter. This consequently may allow an...

anymodality (0.1.0), autogluon-cloud (>=0.1.1b20230324, <=0.2.1b20230929) +21 more potentially affected by CVE-2024-34073 via sagemaker (>=2.16.1, <=2.207.1)

sagemaker PYPI version =2.16.1, =0.1.1b20230324, =0.1.17, =0.9.0, =1.0.0, =1.97.0.dev0, =1.0.0, =1.0.0, =0.1.2, =0.0.9, =0.1.6, =0.0.1, =0.2.0, =0.5.1 and more Source cves: CVE-2024-34073 Source advisory: OSV:PYSEC-2026-1887...

hydro-integrations (2.3.0.dev0) potentially affected by CVE-2024-34073 via sagemaker (1.52.1)

sagemaker PYPI version 1.52.1 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - hydro-integrations 2.3.0.dev0 Source cves: CVE-2024-34073 Source advisory: OSV:PYSEC-2026-1887...

ezsmdeploy (0.2.9) potentially affected by CVE-2024-34073 via sagemaker (1.60.0)

sagemaker PYPI version 1.60.0 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - ezsmdeploy 0.2.9 Source cves: CVE-2024-34073 Source advisory: OSV:PYSEC-2026-1887...

anymodality (0.1.0), autogluon-cloud (>=0.1.1b20230324, <=0.2.1b20230929) +21 more potentially affected by CVE-2024-34072 via sagemaker (>=2.16.1, <=2.207.1)

sagemaker PYPI version =2.16.1, =0.1.1b20230324, =0.1.17, =0.9.0, =1.0.0, =1.97.0.dev0, =1.0.0, =1.0.0, =0.1.2, =0.0.9, =0.1.6, =0.0.1, =0.2.0, =0.5.1 and more Source cves: CVE-2024-34072 Source advisory: OSV:PYSEC-2026-1889...

sagemaker-python-sdk vulnerable to Deserialization of Untrusted Data

Impactsagemaker.basedeserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both...

ezsmdeploy (>=0.2.8, <=0.3.1) potentially affected by CVE-2024-34073 via sagemaker (1.58.2)

sagemaker PYPI version 1.58.2 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - ezsmdeploy =0.2.8, =0.3.1 Source cves: CVE-2024-34073 Source advisory: OSV:PYSEC-2026-1887...

ezsmdeploy (0.2.9) potentially affected by CVE-2024-34072 via sagemaker (1.60.0)

sagemaker PYPI version 1.60.0 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - ezsmdeploy 0.2.9 Source cves: CVE-2024-34072 Source advisory: OSV:PYSEC-2026-1889...

PYSEC-2026-1889 sagemaker-python-sdk vulnerable to Deserialization of Untrusted Data

Impact sagemaker.basedeserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both...

hydro-integrations (2.3.0.dev0) potentially affected by CVE-2024-34072 via sagemaker (1.52.1)

sagemaker PYPI version 1.52.1 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - hydro-integrations 2.3.0.dev0 Source cves: CVE-2024-34072 Source advisory: OSV:PYSEC-2026-1889...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Nvidia Triton_Inference_Server

CVE-2026-24207 / 24206 — NVIDIA Triton Inference Server SageMa...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Nvidia Triton_Inference_Server

CVE-2026-24207 / 24206 — NVIDIA Triton Inference Server SageMa...

amazon-sagemaker-sql-editor (>=0.1.1, <=0.1.21), apache-airflow-providers-amazon (>=9.7.0rc1, <=9.8.0) +42 more potentially affected by CVE-2026-8838 via redshift-connector (>=2.0.888, <=2.1.13)

redshift-connector PYPI version =2.0.888, =0.1.1, =9.7.0rc1, =1.0.0, =0.1.1, =2.0.0, =0.1.7, =0.31.6, =0.1.17, =2.3.0.dev3, =1.0.0a1, =0.4.0, =0.0.1, =0.3.64, =6.1.2, =0.5.2, =0.6.1 and more Source cves: CVE-2026-8838 Source advisory: OSV:GHSA-29H4-R29X-HCHV...

Improper Integrity Verification

Amazon SageMaker Python SDK is vulnerable to improper integrity verification. The vulnerability is due to missing integrity verification in the Triton inference handler, which allows an authenticated attacker with S3 write access to replace model artifacts with a specially crafted pickle payload...

Malicious code in cdk-sagemaker-notebook-workflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cc9c1db01ca14b294be21438478ec14dc6549a4b7b9ec5cf73dd7aa227f7ad8 The package declares a preinstall hook node index.js in package.json that fires automatically on npm install. The script collects os.hostname,...

MAL-2026-4255 Malicious code in cdk-sagemaker-notebook-workflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cc9c1db01ca14b294be21438478ec14dc6549a4b7b9ec5cf73dd7aa227f7ad8 The package declares a preinstall hook node index.js in package.json that fires automatically on npm install. The script collects os.hostname,...

amzn-nova-customization-sdk (1.3.14), amzn-nova-forge (1.3.14) potentially affected by CVE-2026-8597 via sagemaker-serve (1.5.0)

sagemaker-serve PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker-serve and may be impacted: - amzn-nova-customization-sdk 1.3.14 - amzn-nova-forge 1.3.14 Source cves: CVE-2026-8597 Source advisory:...