22307 matches found
CVE-2022-23591
Tensorflow is an Open Source Machine Learning Framework. The GraphDef format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a GraphDef containing a fragment such as the following can be consumed when loading a SavedModel. This...
CVE-2022-23584
Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a use after free behavior when decoding PNG images. After png::CommonFreeDecode gets called, the values of decode.width and decode.height are in an unspecified state. The fix will be included in TensorFlow 2.8.0. ...
CVE-2022-23573
Tensorflow is an Open Source Machine Learning Framework. The implementation of AssignOp can result in copying uninitialized data to a new tensor. This later results in undefined behavior. The implementation has a check that the left hand side of the assignment is initialized to minimize number of...
CVE-2022-23566
Tensorflow is an Open Source Machine Learning Framework. TensorFlow is vulnerable to a heap OOB write in Grappler. The setoutput function writes to an array at the specified index. Hence, this gives a malicious user a write primitive. The fix will be included in TensorFlow 2.8.0. We will also...
CVE-2022-35939
TensorFlow is an open source platform for machine learning. The ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. We have...
CVE-2022-35937
TensorFlow is an open source platform for machine learning. The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. This issue has been patched in...
CVE-2022-35938
TensorFlow is an open source platform for machine learning. The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. This issue has been...
AZL-74153 CVE-2026-21441 affecting package tensorflow for versions less than 2.16.1-10
urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP...
CVE-2019-16778
In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case datasize and numsegments fields are truncated from int64 to int32 and can produce negative numbers, resulting in accessing out of bounds heap memory. Thi...
GHSA-C9RC-MG46-23W3 vulnerabilities
Vulnerabilities for packages: tensorflow-cpu-jupyter...
GHSA-36RR-WW3J-VRJV vulnerabilities
Vulnerabilities for packages: tensorflow-cpu-jupyter...
CVE-2025-9905 vulnerabilities
Vulnerabilities for packages: tensorflow-cpu-jupyter...
GHSA-C9RC-MG46-23W3 vulnerabilities
Vulnerabilities for packages: tensorflow-cpu-jupyter, tensorflow-gpu-jupyter...
GHSA-768J-98CG-P3FV vulnerabilities
Vulnerabilities for packages: mlflow, open-webui, tensorflow-cpu-jupyter, tensorflow-gpu-jupyter...
CVE-2025-66034 vulnerabilities
Vulnerabilities for packages: mlflow, open-webui, tensorflow-cpu-jupyter, tensorflow-gpu-jupyter...
cryoet-deepfinder (0.2.1), cspot (>=1.0.4, <=1.0.16) +9 more potentially affected by CVE-2025-12060 via keras (2.14.0rc0)
keras PYPI version 2.14.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - cryoet-deepfinder 0.2.1 - cspot =1.0.4, =2.1.0, =0.4.0, =2.13.0rc0, =2.13.0rc0, =2.13.0rc2 - tensorflow-text 2.12.0rc0 - tfrec-literate 2.10.0rc1...
hydra-rbp (>=0.1.21.29, <=0.1.21.38), phasespace (>=1.5.0, <=1.6.0) +4 more potentially affected by CVE-2025-12060 via keras (2.7.0rc2)
keras PYPI version 2.7.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - hydra-rbp =0.1.21.29, =1.5.0, =2.6.0rc1, =0.18.0.dev20210402154254, =0.3.0, =0.3.2 Source cves: CVE-2025-12060 Source advisory:...
cosmopower (0.2.0), guardrail-ml (>=0.0.14, <=0.0.15) +7 more potentially affected by CVE-2025-12060 via keras (2.15.0rc1)
keras PYPI version 2.15.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - cosmopower 0.2.0 - guardrail-ml =0.0.14, =0.5.10, =0.1.0, =2.14.0rc0, =2.14.0rc0, =2.14.0rc1 - tensorflow-text 2.13.0rc0 - tf-extensions 0.1.0...
tensorflow (2.6.0rc0) potentially affected by CVE-2025-12060 via keras (2.6.0rc0)
keras PYPI version 2.6.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - tensorflow 2.6.0rc0 Source cves: CVE-2025-12060 Source advisory: OSV:GHSA-HJQC-JX6G-RWP9...