TensorFlow vulnerable to Out-of-Bounds Read in GRUBlockCellGrad

ImpactOut of bounds read in GRUBlockCellGradpythonfunc = tf.rawops.GRUBlockCellGradpara = 'x': 21.1, 156.2, 83.3, 115.4, 'hprev': array136.5, 136.6, 'wru': array26.7, 0.8, 47.9, 26.1, 26.2, 26.3, 'wc': array 0.4, 31.5, 0.6, 'bru': array0.1, 0.2 , dtype=float32, 'bc': 0x41414141, 'r': array0.3, 0....

PYSEC-2026-961 TensorFlow has null dereference on ParallelConcat with XLA

Impact When running with XLA, tf.rawops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. python import tensorflow as tf func = tf.rawops.ParallelConcat para = 'shape': 0, 'values': 1 @tf.functionjitcompile=True def test: y =...

strawberryfields-gpu (>=0.7.3, <=0.10.0) potentially affected by CVE-2023-25658 via tensorflow-gpu (1.6.0)

tensorflow-gpu PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - strawberryfields-gpu =0.7.3, =0.10.0 Source cves: CVE-2023-25658 Source advisory: OSV:PYSEC-2026-960...

delft (0.2.2) potentially affected by CVE-2023-25658 via tensorflow-gpu (1.9.0)

tensorflow-gpu PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - delft 0.2.2 Source cves: CVE-2023-25658 Source advisory: OSV:PYSEC-2026-960...

relion-yolo-it (0.1.3) potentially affected by CVE-2023-25658 via tensorflow-gpu (1.10.1)

tensorflow-gpu PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - relion-yolo-it 0.1.3 Source cves: CVE-2023-25658 Source advisory: OSV:PYSEC-2026-960...

deepdefacer (>=0.0.2, <=1.0.4), delft (>=0.1.2, <=0.2.0) potentially affected by CVE-2023-25658 via tensorflow-gpu (1.8.0)

tensorflow-gpu PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - deepdefacer =0.0.2, =0.1.2, =0.2.0 Source cves: CVE-2023-25658 Source advisory: OSV:PYSEC-2026-960...

niftynet (0.1.1rc58) potentially affected by CVE-2023-25658 via tensorflow-gpu (1.1.0)

tensorflow-gpu PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - niftynet 0.1.1rc58 Source cves: CVE-2023-25658 Source advisory: OSV:PYSEC-2026-960...

relion-yolo-it (0.1.3) potentially affected by CVE-2023-25675 via tensorflow-gpu (1.10.1)

tensorflow-gpu PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - relion-yolo-it 0.1.3 Source cves: CVE-2023-25675 Source advisory: OSV:PYSEC-2026-967...

aggmap (>=1.1.1, <=1.2.1), animl (>=1.1.2, <=1.1.4) +55 more potentially affected by CVE-2023-27579 via tensorflow-gpu (>=2.0.0, <=2.10.1)

tensorflow-gpu PYPI version =2.0.0, =1.1.1, =1.1.2, =0.0.1, =0.0.9, =0.2.1, =0.1.0, =0.0.4, =1.1.1, =1.1.0, =1.4.0 and more Source cves: CVE-2023-27579 Source advisory: OSV:PYSEC-2026-954...

PYSEC-2026-954 TensorFlow has Floating Point Exception in TFLite in conv kernel

Impact Constructing a tflite model with a paramater filterinputchannel of less than 1 gives a FPE. Patches We have patched the issue in GitHub commit 34f8368c535253f5c9cb3a303297743b62442aaa. The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1. Fo...

TensorFlow has Floating Point Exception in TFLite in conv kernel

ImpactConstructing a tflite model with a paramater filterinputchannel of less than 1 gives a FPE. PatchesWe have patched the issue in GitHub commit 34f8368c535253f5c9cb3a303297743b62442aaa.The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1. For...

dragonn (0.4.2), dream-on-gym (0.0.1) +5 more potentially affected by CVE-2023-27579 via tensorflow-gpu (1.15.0)

tensorflow-gpu PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - dragonn 0.4.2 - dream-on-gym 0.0.1 - ml4a =0.1.0, =0.0.3, =0.3.0, =0.9.0, =0.0.5, =0.0.88 Source cves: CVE-2023-27579 Source...

delft (>=0.2.3, <=0.2.4), keras-textclassification (0.1.6) +10 more potentially affected by CVE-2023-27579 via tensorflow-gpu (1.12.0)

tensorflow-gpu PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - delft =0.2.3, =0.0.1, =0.0.1, =0.0.2 - monk-keras-cuda92 0.0.1 - monk-keras-cuda92-test 0.0.1 Source cves: CVE-2023-27579 Source...

arekit (>=0.21.0, <=0.22.1), arenets (>=0.23.0, <=0.23.1) +19 more potentially affected by CVE-2023-27579 via tensorflow-gpu (1.14.0)

tensorflow-gpu PYPI version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - arekit =0.21.0, =0.23.0, =1.0.0, =0.0.1, =0.1.6, =0.1.0, =0.0.6, =1.0.1, =1.0.2 - ocrd-anybaseocr 0.0.1 and more Source cves:...

bert-multitask-learning (>=0.1.0, <=0.2.9), miscnn (>=0.6.0, <=0.28.0) potentially affected by CVE-2023-27579 via tensorflow-gpu (1.13.1)

tensorflow-gpu PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - bert-multitask-learning =0.1.0, =0.6.0, =0.28.0 Source cves: CVE-2023-27579 Source advisory: OSV:PYSEC-2026-954...

audeep (>=0.9.2, <=0.9.6a1), cryocare (>=0.0.1, <=0.0.2) +17 more potentially affected by CVE-2023-27579 via tensorflow-gpu (1.15.5)

tensorflow-gpu PYPI version 1.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - audeep =0.9.2, =0.0.1, =0.6.7a1, =0.2.5, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.3.0, =0.0.4, =0.1.3, =0.4.0, =0.0.6, =0.0.8 and more...

jlpyutils (>=0.0.7, <=0.1.1) potentially affected by CVE-2023-27579 via tensorflow-gpu (1.12.2)

tensorflow-gpu PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - jlpyutils =0.0.7, =0.1.1 Source cves: CVE-2023-27579 Source advisory: OSV:PYSEC-2026-954...

nuclear-python (>=0.14.4.1, <=0.14.6.2) potentially affected by CVE-2023-27579 via tensorflow-gpu (1.13.2)

tensorflow-gpu PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - nuclear-python =0.14.4.1, =0.14.6.2 Source cves: CVE-2023-27579 Source advisory: OSV:PYSEC-2026-954...

deepdefacer (>=0.0.2, <=1.0.4), delft (>=0.1.2, <=0.2.0) potentially affected by CVE-2023-27579 via tensorflow-gpu (1.8.0)

tensorflow-gpu PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - deepdefacer =0.0.2, =0.1.2, =0.2.0 Source cves: CVE-2023-27579 Source advisory: OSV:PYSEC-2026-954...

niftynet (0.1.1rc58) potentially affected by CVE-2023-27579 via tensorflow-gpu (1.1.0)

tensorflow-gpu PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - niftynet 0.1.1rc58 Source cves: CVE-2023-27579 Source advisory: OSV:PYSEC-2026-954...