deepdefacer (>=0.0.2, <=1.0.4), delft (>=0.1.2, <=0.2.0) potentially affected by CVE-2022-41909 via tensorflow-gpu (1.8.0)

tensorflow-gpu PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - deepdefacer =0.0.2, =0.1.2, =0.2.0 Source cves: CVE-2022-41909 Source advisory: OSV:PYSEC-2026-1034...

classitransformers (0.0.1), pyclue (>=0.1.0, <=0.1.2) +4 more potentially affected by CVE-2022-41909 via tensorflow-gpu (1.15.2)

tensorflow-gpu PYPI version 1.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - classitransformers 0.0.1 - pyclue =0.1.0, =0.1.1, =0.1.2, =0.1.2, =0.1.3 Source cves: CVE-2022-41909 Source advisory:...

aggmap (>=1.1.1, <=1.2.1), molmap (>=1.3.1, <=1.4.0) potentially affected by CVE-2022-41910 via tensorflow-gpu (2.9.1)

tensorflow-gpu PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - aggmap =1.1.1, =1.3.1, =1.4.0 Source cves: CVE-2022-41910 Source advisory: OSV:PYSEC-2026-992...

jlpyutils (>=0.0.7, <=0.1.1) potentially affected by CVE-2022-41900 via tensorflow-gpu (1.12.2)

tensorflow-gpu PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - jlpyutils =0.0.7, =0.1.1 Source cves: CVE-2022-41900 Source advisory: OSV:PYSEC-2026-1049...

delft (0.2.2) potentially affected by CVE-2022-41900 via tensorflow-gpu (1.9.0)

tensorflow-gpu PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - delft 0.2.2 Source cves: CVE-2022-41900 Source advisory: OSV:PYSEC-2026-1049...

niftynet (0.1.1rc58) potentially affected by CVE-2022-41910 via tensorflow-gpu (1.1.0)

tensorflow-gpu PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - niftynet 0.1.1rc58 Source cves: CVE-2022-41910 Source advisory: OSV:PYSEC-2026-992...

audeep (>=0.9.2, <=0.9.6a1), cryocare (>=0.0.1, <=0.0.2) +17 more potentially affected by CVE-2022-41910 via tensorflow-gpu (1.15.5)

tensorflow-gpu PYPI version 1.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - audeep =0.9.2, =0.0.1, =0.6.7a1, =0.2.5, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.3.0, =0.0.4, =0.1.3, =0.4.0, =0.0.6, =0.0.8 and more...

strawberryfields-gpu (>=0.7.3, <=0.10.0) potentially affected by CVE-2022-41910 via tensorflow-gpu (1.6.0)

tensorflow-gpu PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - strawberryfields-gpu =0.7.3, =0.10.0 Source cves: CVE-2022-41910 Source advisory: OSV:PYSEC-2026-992...

Buffer overflow in `CONV_3D_TRANSPOSE` on TFLite

ImpactThe reference kernel of the CONV3DTRANSPOSE TensorFlow Lite operator wrongly increments the dataptr when adding the bias to the result.Instead of dataptr += numchannels; it should be dataptr += outputnumchannels; as if the number of input channels is different than the number of output...

`CHECK` fail via inputs in `PyFunc`

ImpactAn input token that is not a UTF-8 bytestring will trigger a CHECK fail in tf.rawops.PyFunc.pythonimport tensorflow as tfvalue = tf.constantvalue=1,2token = b'\xb0'dataType = tf.int32tf.rawops.PyFuncinput=value,token=token,Tout=dataType PatchesWe have patched the issue in GitHub commit...

PYSEC-2026-992 Heap overflow in `QuantizeAndDequantizeV2`

Impact The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. python import tensorflow as tf @tf.function def test:...

PYSEC-2026-1049 FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess

Impact An input poolingratio that is smaller than 1 will trigger a heap OOB in tf.rawops.FractionalMaxPool and tf.rawops.FractionalAvgPool. Patches We have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48. The fix will be included in TensorFlow 2.11.0. We will also cher...

animl (>=1.1.2, <=1.1.4), audio-classification-models (1.0.1) +50 more potentially affected by CVE-2022-41910 via tensorflow-gpu (>=2.0.0, <=2.8.3)

tensorflow-gpu PYPI version =2.0.0, =1.1.2, =0.0.1, =0.0.9, =0.2.1, =0.1.0, =0.0.4, =1.1.1, =1.1.0, =0.1.1, =0.1.0, =0.1.7 and more Source cves: CVE-2022-41910 Source advisory: OSV:PYSEC-2026-992...

jlpyutils (>=0.0.7, <=0.1.1) potentially affected by CVE-2022-41910 via tensorflow-gpu (1.12.2)

tensorflow-gpu PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - jlpyutils =0.0.7, =0.1.1 Source cves: CVE-2022-41910 Source advisory: OSV:PYSEC-2026-992...

`CHECK_EQ` fail in `tf.raw_ops.TensorListResize`

ImpactIf tf.rawops.TensorListResize is given a nonscalar value for input size, it results CHECK fail which can be used to trigger a denial of service attack.pythonimport numpy as npimport tensorflow as tfa = datastructures.tftensorlistnewelements = tf.constantvalue=3, 4, 5b = np.zeros0, 2, 3,...

vcap (>=0.2.4.dev13, <=0.3.1) potentially affected by CVE-2022-41902 via tensorflow-gpu (1.15.4)

tensorflow-gpu PYPI version 1.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - vcap =0.2.4.dev13, =0.3.1 Source cves: CVE-2022-41902 Source advisory: OSV:PYSEC-2026-981...

Out of bounds write in grappler in Tensorflow

ImpactThe function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. PatchesWe have patched the issue in GitHub commit...

dragonn (0.4.2), dream-on-gym (0.0.1) +5 more potentially affected by CVE-2022-41907 via tensorflow-gpu (1.15.0)

tensorflow-gpu PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - dragonn 0.4.2 - dream-on-gym 0.0.1 - ml4a =0.1.0, =0.0.3, =0.3.0, =0.9.0, =0.0.5, =0.0.88 Source cves: CVE-2022-41907 Source...

strawberryfields-gpu (>=0.7.3, <=0.10.0) potentially affected by CVE-2022-41902 via tensorflow-gpu (1.6.0)

tensorflow-gpu PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - strawberryfields-gpu =0.7.3, =0.10.0 Source cves: CVE-2022-41902 Source advisory: OSV:PYSEC-2026-981...

delft (>=0.2.3, <=0.2.4), keras-textclassification (0.1.6) +10 more potentially affected by CVE-2022-41900 via tensorflow-gpu (1.12.0)

tensorflow-gpu PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - delft =0.2.3, =0.0.1, =0.0.1, =0.0.2 - monk-keras-cuda92 0.0.1 - monk-keras-cuda92-test 0.0.1 Source cves: CVE-2022-41900 Source...