55006 matches found
AZL-108552 CVE-2026-78663 affecting package tensorflow 2.16.1-11
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-108546 CVE-2026-78667 affecting package tensorflow 2.16.1-11
When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...
AZL-108540 CVE-2026-78659 affecting package tensorflow 2.16.1-11
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-108537 CVE-2026-78660 affecting package tensorflow 2.16.1-11
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
AZL-107928 CVE-2026-56866 affecting package tensorflow 2.16.1-11
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...
CVE-2026-61782 vulnerabilities
Vulnerabilities for packages: tensorflow-gpu-jupyter, jupyter-base-notebook...
GHSA-JMG2-RCXH-W8Q3 vulnerabilities
Vulnerabilities for packages: tensorflow-gpu-jupyter, jupyter-base-notebook...
GHSA-VFJ7-8CJW-P6XM vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, airflow, argo-workflows, arangodb, commercial-gitlab-rails-ee-fips, thingsboard-fips, langfuse, eco-jess, airflow-core, openspec-fips, tileserver-gl, commitizen, verdaccio, prism, thingsboard, kubeflow-pipelines, gitlab-rails-ce-fips, gitlab-rails-ce...
CVE-2026-93687 vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, airflow, argo-workflows, arangodb, commercial-gitlab-rails-ee-fips, thingsboard-fips, langfuse, eco-jess, airflow-core, openspec-fips, tileserver-gl, commitizen, verdaccio, prism, thingsboard, kubeflow-pipelines, gitlab-rails-ce-fips, gitlab-rails-ce...
GHSA-VC2V-76PW-4V95 vulnerabilities
Vulnerabilities for packages: unleash, tensorflow-gpu-jupyter, code-server, unleash-proxy, arangodb, vitess, serve, unleash-fips, verdaccio, thingsboard, jupyter-base-notebook, gitlab-rails-ce-fips, dotstatsuite-supercore, gitlab-rails-ce...
CVE-2026-87776 vulnerabilities
Vulnerabilities for packages: unleash, tensorflow-gpu-jupyter, code-server, unleash-proxy, arangodb, vitess, serve, unleash-fips, verdaccio, thingsboard, jupyter-base-notebook, gitlab-rails-ce-fips, dotstatsuite-supercore, gitlab-rails-ce...
CVE-2026-103923 vulnerabilities
Vulnerabilities for packages: tensorflow-gpu-jupyter, code-server, renovate, langfuse-fips, commercial-gitlab-rails-ee-fips, librechat, commercial-gitlab-rails-ee, jupyter-base-notebook, langfuse, gitlab-rails-ce-fips, gitlab-rails-ce...
GHSA-238P-PMPM-9MQ7 vulnerabilities
Vulnerabilities for packages: tensorflow-gpu-jupyter, code-server, renovate, langfuse-fips, commercial-gitlab-rails-ee-fips, librechat, commercial-gitlab-rails-ee, jupyter-base-notebook, langfuse, gitlab-rails-ce-fips, gitlab-rails-ce...
CVE-2026-93748 vulnerabilities
Vulnerabilities for packages: prism, tensorflow-gpu-jupyter...
GHSA-CH52-4W7C-C8XP vulnerabilities
Vulnerabilities for packages: prism, tensorflow-gpu-jupyter...
GHSA-JVVF-X445-J334 vulnerabilities
Vulnerabilities for packages: tensorflow-gpu-jupyter...
CVE-2026-86818 vulnerabilities
Vulnerabilities for packages: tensorflow-gpu-jupyter...
AZL-105918 CVE-2026-19553 affecting package tensorflow 2.16.1-11
ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in SSLObject, if the serverhostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to...
AZL-105912 CVE-2026-12345 affecting package tensorflow 2.16.1-11
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the...
