30895 matches found
PYSEC-2026-3094 Null pointer dereference in TensorFlow
Impact The implementation of QuantizedMaxPool has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer. python import tensorflow as tf tf.rawops.QuantizedMaxPool input = tf.constant4, dtype=tf.quint8, mininput = , maxinput = 1, ksize = 1, 1, 1, 1,...
PYSEC-2026-3164 Assertion failure based denial of service in Tensorflow
Impact The implementation of Bincount operations allows malicious users to cause denial of service by passing in arguments which would trigger a CHECK-fail: python import tensorflow as tf tf.rawops.DenseBincount input=0, 1, 2, size=1, weights=3,2,1, binaryoutput=False There are several conditions...
PYSEC-2026-3173 Null pointer dereference in TensorFlow
Impact When building an XLA compilation cache, if default settings are used, TensorFlow triggers a null pointer dereference: cc string allowedgpus = flr-configproto-gpuoptions.visibledevicelist; In the default scenario, all devices are allowed, so flr-configproto is nullptr. Patches We have patch...
PYSEC-2026-3153 Null-dereference in Tensorflow
Impact When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK: cc const auto attr = attrs.Findarg-s; DCHECKattr != nullptr; if attr-valuecase == AttrValue::kLis...
PYSEC-2026-3229 Uninitialized variable access in Tensorflow
Impact The implementation of AssignOp can result in copying unitialized data to a new tensor. This later results in undefined behavior. The implementation has a check that the left hand side of the assignment is initialized to minimize number of allocations, but does not check that the right hand...
PYSEC-2026-3096 Multiple `CHECK`-fails in `function.cc` in TensowFlow
Impact A malicious user can cause a denial of service by altering a SavedModel such that assertions in function.cc would be falsified and crash the Python interpreter. Patches We have patched the issue in GitHub commits dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2 and...
PYSEC-2026-3174 Memory leak in decoding PNG images
Impact When decoding PNG images TensorFlow can produce a memory leak if the image is invalid. After calling png::CommonInitDecode..., &decode, the decode value contains allocated buffers which can only be freed by calling png::CommonFreeDecode&decode. However, several error case in the function...
PYSEC-2026-3159 Integer overflow in Tensorflow
Impact The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness: python import tensorflow as tf input = tf.constant1,1,dtype=tf.qint32 @tf.function def test: y = tf.rawops.Dequantize input=input, minrange=1.0, maxrange=10.0, mode='MINCOMBINED',...
PYSEC-2026-3175 `CHECK`-failures during Grappler's `IsSimplifiableReshape` in Tensorflow
Impact The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a SavedModel such that IsSimplifiableReshape would trigger CHECK failures. Patches We have patched the issue in GitHub commits ebc1a2ffe5a7573d905e99bd0ee3568ee07c12c1,...
CVE-2026-61474
An improper authorization check in MISP’s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharinggroupid without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly s...
CVE-2026-61474 MISP: Improper sharing group authorization check when adding attributes
An improper authorization check in MISP’s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharinggroupid without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly s...
DEBIAN-CVE-2026-15185
A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsubreadidx of the file /src/mediatools/vobsub.c of the component MP4Box. Executing a manipulation of the argument numlangs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been...
OESA-2026-2939 coredns security update
CoreDNS is a fast and flexible DNS server. The key word here is flexible: with CoreDNS you are able to do what you want with your DNS data by utilizing plugins. Security Fixes: CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS acce...
CVE-2026-15182 GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow
A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwgbmp of the file src/dwg.c of the component BMP Image Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the...
ROOT-OS-DEBIAN-12-CVE-2026-4873 CVE-2026-4873 in rootio-curl - Patched by Root
Root has patched CVE-2026-4873 in the rootio-curl package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2025-10966 CVE-2025-10966 in rootio-curl - Patched by Root
Root has patched CVE-2025-10966 in the rootio-curl package for Root:Debian:12. Multiple fixed versions available...
GHSA-9QM4-RH6W-PQ5X DSpace: Path Traversal is possible through LDN message generation
Overview A path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. This vulnerability impacts DSpace versions 8.0 = 8.3, 9.0 = 9.2. The attacker MUST already have DSpace administrator credentials in order to perform the attack. When reading a file input stream of an...
CVE-2026-44840 Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the checkUserPassword GraphQL query in Dgraph is vulnerable to DQL Dgraph Query Language injection. User-supplied password values are interpolated directly into a DQL checkpwd query via fmt.Sprintf without any escapin...