strawberryfields-gpu (>=0.7.3, <=0.10.0) potentially affected by CVE-2022-41886 via tensorflow-gpu (1.6.0)

tensorflow-gpu PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - strawberryfields-gpu =0.7.3, =0.10.0 Source cves: CVE-2022-41886 Source advisory: OSV:PYSEC-2026-951...

jlpyutils (>=0.0.7, <=0.1.1) potentially affected by CVE-2022-41886 via tensorflow-gpu (1.12.2)

tensorflow-gpu PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - jlpyutils =0.0.7, =0.1.1 Source cves: CVE-2022-41886 Source advisory: OSV:PYSEC-2026-951...

audeep (>=0.9.2, <=0.9.6a1), cryocare (>=0.0.1, <=0.0.2) +17 more potentially affected by CVE-2022-41886 via tensorflow-gpu (1.15.5)

tensorflow-gpu PYPI version 1.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - audeep =0.9.2, =0.0.1, =0.6.7a1, =0.2.5, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.3.0, =0.0.4, =0.1.3, =0.4.0, =0.0.6, =0.0.8 and more...

PYSEC-2026-970 Overflow in `tf.keras.losses.poisson`

Impact tf.keras.losses.poisson receives a ypred and ytrue that are passed through functor::mul in BinaryOp. If the resulting dimensions overflow an int32, TensorFlow will crash due to a size mismatch during broadcast assignment. python import numpy as np import tensorflow as tf truevalue =...

animl (>=1.1.2, <=1.1.4), audio-classification-models (1.0.1) +50 more potentially affected by CVE-2022-41890 via tensorflow-gpu (>=2.0.0, <=2.8.3)

tensorflow-gpu PYPI version =2.0.0, =1.1.2, =0.0.1, =0.0.9, =0.2.1, =0.1.0, =0.0.4, =1.1.1, =1.1.0, =0.1.1, =0.1.0, =0.1.7 and more Source cves: CVE-2022-41890 Source advisory: OSV:PYSEC-2026-1001...

PYSEC-2026-1042 Out of bounds segmentation fault due to unequal op inputs in Tensorflow

Impact tf.rawops.DynamicStitch specifies input sizes when it is registered. cpp REGISTEROP"DynamicStitch" .Input"indices: N int32" .Input"data: N T" .Output"merged: T" .Attr"N : int = 1" .Attr"T : type" .SetShapeFnDynamicStitchShapeFunction; When it receives a differing number of inputs, such as...

Segfault in `tf.raw_ops.TensorListConcat`

ImpactIf tf.rawops.TensorListConcat is given elementshape=, it results segmentation fault which can be used to trigger a denial of service attack.pythonimport tensorflow as tftf.rawops.TensorListConcat inputhandle=tf.data.experimental.tovarianttf.data.Dataset.fromtensorslices1, 2, 3,...

bert-multitask-learning (>=0.1.0, <=0.2.9), miscnn (>=0.6.0, <=0.28.0) potentially affected by CVE-2022-41890 via tensorflow-gpu (1.13.1)

tensorflow-gpu PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - bert-multitask-learning =0.1.0, =0.6.0, =0.28.0 Source cves: CVE-2022-41890 Source advisory: OSV:PYSEC-2026-1001...

jlpyutils (>=0.0.7, <=0.1.1) potentially affected by CVE-2022-41890 via tensorflow-gpu (1.12.2)

tensorflow-gpu PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - jlpyutils =0.0.7, =0.1.1 Source cves: CVE-2022-41890 Source advisory: OSV:PYSEC-2026-1001...

animl (>=1.1.2, <=1.1.4), audio-classification-models (1.0.1) +50 more potentially affected by CVE-2022-41886 via tensorflow-gpu (>=2.0.0, <=2.8.3)

tensorflow-gpu PYPI version =2.0.0, =1.1.2, =0.0.1, =0.0.9, =0.2.1, =0.1.0, =0.0.4, =1.1.1, =1.1.0, =0.1.1, =0.1.0, =0.1.7 and more Source cves: CVE-2022-41886 Source advisory: OSV:PYSEC-2026-951...

Overflow in `FusedResizeAndPadConv2D`

ImpactWhen tf.rawops.FusedResizeAndPadConv2D is given a large tensor shape, it overflows.pythonimport tensorflow as tfmode = "REFLECT"strides = 1, 1, 1, 1padding = "SAME"resizealigncorners = Falseinput = tf.constant147, shape=3,3,1,1, dtype=tf.float16size = tf.constant1879048192,1879048192,...

PYSEC-2026-1050 Segfault via invalid attributes in `pywrap_tfe_src.cc`

Impact If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tensor and returns a nullptr, which is not caught. An example can be seen in tf.compat.v1.extractvolumepatches by passing in quantized tensors as input ksizes. python import numpy as np import...

delft (0.2.2) potentially affected by CVE-2022-41889 via tensorflow-gpu (1.9.0)

tensorflow-gpu PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - delft 0.2.2 Source cves: CVE-2022-41889 Source advisory: OSV:PYSEC-2026-1050...

nuclear-python (>=0.14.4.1, <=0.14.6.2) potentially affected by CVE-2022-41887 via tensorflow-gpu (1.13.2)

tensorflow-gpu PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - nuclear-python =0.14.4.1, =0.14.6.2 Source cves: CVE-2022-41887 Source advisory: OSV:PYSEC-2026-970...

deepdefacer (>=0.0.2, <=1.0.4), delft (>=0.1.2, <=0.2.0) potentially affected by CVE-2022-41887 via tensorflow-gpu (1.8.0)

tensorflow-gpu PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - deepdefacer =0.0.2, =0.1.2, =0.2.0 Source cves: CVE-2022-41887 Source advisory: OSV:PYSEC-2026-970...

delft (>=0.2.3, <=0.2.4), keras-textclassification (0.1.6) +10 more potentially affected by CVE-2022-41887 via tensorflow-gpu (1.12.0)

tensorflow-gpu PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - delft =0.2.3, =0.0.1, =0.0.1, =0.0.2 - monk-keras-cuda92 0.0.1 - monk-keras-cuda92-test 0.0.1 Source cves: CVE-2022-41887 Source...

vcap (>=0.2.4.dev13, <=0.3.1) potentially affected by CVE-2022-41889 via tensorflow-gpu (1.15.4)

tensorflow-gpu PYPI version 1.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - vcap =0.2.4.dev13, =0.3.1 Source cves: CVE-2022-41889 Source advisory: OSV:PYSEC-2026-1050...

strawberryfields-gpu (>=0.7.3, <=0.10.0) potentially affected by CVE-2022-41887 via tensorflow-gpu (1.6.0)

tensorflow-gpu PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - strawberryfields-gpu =0.7.3, =0.10.0 Source cves: CVE-2022-41887 Source advisory: OSV:PYSEC-2026-970...

aggmap (>=1.1.1, <=1.2.1), molmap (>=1.3.1, <=1.4.0) potentially affected by CVE-2022-41889 via tensorflow-gpu (2.9.1)

tensorflow-gpu PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - aggmap =1.1.1, =1.3.1, =1.4.0 Source cves: CVE-2022-41889 Source advisory: OSV:PYSEC-2026-1050...

relion-yolo-it (0.1.3) potentially affected by CVE-2022-41887 via tensorflow-gpu (1.10.1)

tensorflow-gpu PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - relion-yolo-it 0.1.3 Source cves: CVE-2022-41887 Source advisory: OSV:PYSEC-2026-970...