azureml-designer-pytorch-modules (>=0.0.1, <=0.0.12), deberta (0.1.4) +10 more potentially affected by CVE-2025-2999 via torch (1.3.0)

torch PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - azureml-designer-pytorch-modules =0.0.1, =0.0.3, =1.3.0, =0.1.0, =0.1.0, =0.2.0a2, =0.1.0, =0.1.1 Source cves: CVE-2025-2999 Source advisory:...

lightwood (>=0.6.6, <=0.6.7), pytorch-tabnet (>=0.1.0, <=0.1.2) +1 more potentially affected by CVE-2025-2953 via torch (1.0.1)

torch PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - lightwood =0.6.6, =0.1.0, =0.1.2 - syft 0.1.13a1 Source cves: CVE-2025-2953 Source advisory: OSV:GHSA-3749-GHW9-M3MG...

lightwood (>=0.6.6, <=0.6.7), pytorch-tabnet (>=0.1.0, <=0.1.2) +1 more potentially affected by CVE-2025-2953 via torch (1.0.1)

torch PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - lightwood =0.6.6, =0.1.0, =0.1.2 - syft 0.1.13a1 Source cves: CVE-2025-2953 Source advisory: OSV:PYSEC-2025-191...

azureml-designer-pytorch-modules (>=0.0.1, <=0.0.12), deberta (0.1.4) +10 more potentially affected by CVE-2025-2953 via torch (1.3.0)

torch PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - azureml-designer-pytorch-modules =0.0.1, =0.0.3, =1.3.0, =0.1.0, =0.1.0, =0.2.0a2, =0.1.0, =0.1.1 Source cves: CVE-2025-2953 Source advisory:...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: osv-scanner, eksctl, opa-envoy, grype, wolfictl, k3s, kubescape, fuse-overlayfs-snapshotter, xeol, nerdctl, k8ssandra-client, syft, cluster-api-helm-controller, zarf, neuvector-scanner, cert-manager-cmctl, skaffold, kargo, spegel, helm, flux-source-controller,...

lightwood (>=0.6.6, <=0.6.7), pytorch-tabnet (>=0.1.0, <=0.1.2) +1 more potentially affected by CVE-2025-2149 via torch (1.0.1)

torch PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - lightwood =0.6.6, =0.1.0, =0.1.2 - syft 0.1.13a1 Source cves: CVE-2025-2149 Source advisory: OSV:GHSA-X3GM-94WQ-G975...

lightwood (>=0.6.6, <=0.6.7), pytorch-tabnet (>=0.1.0, <=0.1.2) +1 more potentially affected by CVE-2025-2148 via torch (1.0.1)

torch PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - lightwood =0.6.6, =0.1.0, =0.1.2 - syft 0.1.13a1 Source cves: CVE-2025-2148 Source advisory: OSV:GHSA-C678-JFCJ-6JMF...

lightwood (>=0.6.6, <=0.6.7), pytorch-tabnet (>=0.1.0, <=0.1.2) +1 more potentially affected by CVE-2024-48063 via torch (1.0.1)

torch PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - lightwood =0.6.6, =0.1.0, =0.1.2 - syft 0.1.13a1 Source cves: CVE-2024-48063 Source advisory: OSV:PYSEC-2024-259...

artificienlib (>=0.1.1, <=0.1.6), syft (>=0.2.8, <=0.2.9) +8 more potentially affected by CVE-2024-47532 via restrictedpython (5.4.0)

restrictedpython PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - artificienlib =0.1.1, =0.2.8, =0.0.333, =0.0.27, =0.0.70, =0.0.126, =0.0.31, =0.0.30, =0.0.14, =0.0.26 Source cves: CVE-2024-475...

blixa (1.1.4), dothttp-insomnia-importer (0.1.0) +4 more potentially affected by CVE-2024-47532 via restrictedpython (>=7.0.0, <=7.2.0)

restrictedpython PYPI version =7.0.0, =0.0.43a2, =0.5.2, =0.0.5rc1, =0.8.5b2, =0.9.6b6 Source cves: CVE-2024-47532 Source advisory: GHSA-5RFV-66G4-JR8H...

blixa (1.1.4), dothttp-insomnia-importer (0.1.0) +4 more potentially affected by CVE-2024-47532 via restrictedpython (>=7.0.0, <=7.2.0)

restrictedpython PYPI version =7.0.0, =0.0.43a2, =0.5.2, =0.0.5rc1, =0.8.5b2, =0.9.6b6 Source cves: CVE-2024-47532 Source advisory: OSV:PYSEC-2024-186...

artificienlib (>=0.1.1, <=0.1.6), syft (>=0.2.8, <=0.2.9) +8 more potentially affected by CVE-2024-47532 via restrictedpython (5.4.0)

restrictedpython PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - artificienlib =0.1.1, =0.2.8, =0.0.333, =0.0.27, =0.0.70, =0.0.126, =0.0.31, =0.0.30, =0.0.14, =0.0.26 Source cves: CVE-2024-475...

GHSA-JFVP-7X6P-H2PV vulnerabilities

Vulnerabilities for packages: buildah, syft, grafana-alloy, grype, podman, neuvector-scanner, runc, kubernetes, opentelemetry-collector-contrib, k3s, k8s-device-plugin, cadvisor, docker, ctop...

CVE-2024-45310 vulnerabilities

Vulnerabilities for packages: neuvector-fips, opentelemetry-collector-contrib-fips, neuvector, syft, grafana-alloy, grafana-alloy-fips, cadvisor, cadvisor-fips, kubernetes, neuvector-scanner, neuvector-scanner-fips, podman, kubernetes-fips, buildah, gosu, cluster-autoscaler,...

CVE-2024-45310 vulnerabilities

Vulnerabilities for packages: buildah, syft, grafana-alloy, grype, podman, neuvector-scanner, runc, kubernetes, opentelemetry-collector-contrib, k3s, k8s-device-plugin, cadvisor, docker, ctop...

GO-2023-1533 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in github.com/anchore/syft

Credential disclosure in syft when SYFTATTESTPASSWORD environment variable set in github.com/anchore/syft...

GHSA-V23V-6JW2-98FQ vulnerabilities

Vulnerabilities for packages: eksctl, argo-workflows, cosign, bom, grype, vcluster, wolfictl, goreleaser, opentelemetry-collector-contrib, guac, k3s, up, kubescape, cadvisor, gitsign, flux, kubeflow-katib, nerdctl, syft, zarf, opentelemetry-collector, k9s, cert-manager-cmctl, neuvector-scanner,...

lightwood (>=0.6.6, <=0.6.7), pytorch-tabnet (>=0.1.0, <=0.1.2) +1 more potentially affected by CVE-2024-31584 via torch (1.0.1)

torch PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - lightwood =0.6.6, =0.1.0, =0.1.2 - syft 0.1.13a1 Source cves: CVE-2024-31584 Source advisory: OSV:PYSEC-2024-250...

CVE-2024-32473 vulnerabilities

Vulnerabilities for packages: k3d, melange, policy-controller-fips, kaniko, dagger, cri-tools, wolfictl, docker-compose, harbor-scanner-trivy-fips, harbor-scanner-trivy, syft, neuvector-scanner, policy-controller, helm-push, grype, buf...

CVE-2024-32473 vulnerabilities

Vulnerabilities for packages: docker-compose, syft, k3d, grype, melange, harbor-scanner-trivy, neuvector-scanner, wolfictl, kaniko, buf, policy-controller, helm-push, cri-tools, dagger...