TensorFlow vulnerable to OOB read in `Gather_nd` in TF Lite

ImpactThe GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. PatchesWe have patched the issue in GitHub commit...

deepdefacer (>=0.0.2, <=1.0.4), delft (>=0.1.2, <=0.2.0) potentially affected by CVE-2022-35937 via tensorflow-gpu (1.8.0)

tensorflow-gpu PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - deepdefacer =0.0.2, =0.1.2, =0.2.0 Source cves: CVE-2022-35937 Source advisory: OSV:PYSEC-2026-1027...

deepdefacer (>=0.0.2, <=1.0.4), delft (>=0.1.2, <=0.2.0) potentially affected by CVE-2022-36027 via tensorflow-gpu (1.8.0)

tensorflow-gpu PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - deepdefacer =0.0.2, =0.1.2, =0.2.0 Source cves: CVE-2022-36027 Source advisory: OSV:PYSEC-2026-965...

deepdefacer (>=0.0.2, <=1.0.4), delft (>=0.1.2, <=0.2.0) potentially affected by CVE-2022-36026 via tensorflow-gpu (1.8.0)

tensorflow-gpu PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - deepdefacer =0.0.2, =0.1.2, =0.2.0 Source cves: CVE-2022-36026 Source advisory: OSV:PYSEC-2026-976...

deepdefacer (>=0.0.2, <=1.0.4), delft (>=0.1.2, <=0.2.0) potentially affected by CVE-2022-35934 via tensorflow-gpu (1.8.0)

tensorflow-gpu PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - deepdefacer =0.0.2, =0.1.2, =0.2.0 Source cves: CVE-2022-35934 Source advisory: OSV:PYSEC-2026-987...

delft (0.2.2) potentially affected by CVE-2022-35987 via tensorflow-gpu (1.9.0)

tensorflow-gpu PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - delft 0.2.2 Source cves: CVE-2022-35987 Source advisory: OSV:PYSEC-2026-1043...

delft (0.2.2) potentially affected by CVE-2022-35939 via tensorflow-gpu (1.9.0)

tensorflow-gpu PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - delft 0.2.2 Source cves: CVE-2022-35939 Source advisory: OSV:PYSEC-2026-989...

delft (>=0.2.3, <=0.2.4), keras-textclassification (0.1.6) +10 more potentially affected by CVE-2022-35939 via tensorflow-gpu (1.12.0)

tensorflow-gpu PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - delft =0.2.3, =0.0.1, =0.0.1, =0.0.2 - monk-keras-cuda92 0.0.1 - monk-keras-cuda92-test 0.0.1 Source cves: CVE-2022-35939 Source...

jlpyutils (>=0.0.7, <=0.1.1) potentially affected by CVE-2022-36027 via tensorflow-gpu (1.12.2)

tensorflow-gpu PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - jlpyutils =0.0.7, =0.1.1 Source cves: CVE-2022-36027 Source advisory: OSV:PYSEC-2026-965...

jlpyutils (>=0.0.7, <=0.1.1) potentially affected by CVE-2022-35937 via tensorflow-gpu (1.12.2)

tensorflow-gpu PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - jlpyutils =0.0.7, =0.1.1 Source cves: CVE-2022-35937 Source advisory: OSV:PYSEC-2026-1027...

vcap (>=0.2.4.dev13, <=0.3.1) potentially affected by CVE-2022-35937 via tensorflow-gpu (1.15.4)

tensorflow-gpu PYPI version 1.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - vcap =0.2.4.dev13, =0.3.1 Source cves: CVE-2022-35937 Source advisory: OSV:PYSEC-2026-1027...

verse16 (>=0.1.1, <=0.1.2) potentially affected by CVE-2022-36018 via tensorflow-gpu (1.15.3)

tensorflow-gpu PYPI version 1.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - verse16 =0.1.1, =0.1.2 Source cves: CVE-2022-36018 Source advisory: OSV:PYSEC-2026-1016...

verse16 (>=0.1.1, <=0.1.2) potentially affected by CVE-2022-36026 via tensorflow-gpu (1.15.3)

tensorflow-gpu PYPI version 1.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - verse16 =0.1.1, =0.1.2 Source cves: CVE-2022-36026 Source advisory: OSV:PYSEC-2026-976...

audeep (>=0.9.2, <=0.9.6a1), cryocare (>=0.0.1, <=0.0.2) +17 more potentially affected by CVE-2022-35937 via tensorflow-gpu (1.15.5)

tensorflow-gpu PYPI version 1.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - audeep =0.9.2, =0.0.1, =0.6.7a1, =0.2.5, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.3.0, =0.0.4, =0.1.3, =0.4.0, =0.0.6, =0.0.8 and more...

audeep (>=0.9.2, <=0.9.6a1), cryocare (>=0.0.1, <=0.0.2) +17 more potentially affected by CVE-2022-35934 via tensorflow-gpu (1.15.5)

tensorflow-gpu PYPI version 1.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - audeep =0.9.2, =0.0.1, =0.6.7a1, =0.2.5, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.3.0, =0.0.4, =0.1.3, =0.4.0, =0.0.6, =0.0.8 and more...

verse16 (>=0.1.1, <=0.1.2) potentially affected by CVE-2022-35987 via tensorflow-gpu (1.15.3)

tensorflow-gpu PYPI version 1.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - verse16 =0.1.1, =0.1.2 Source cves: CVE-2022-35987 Source advisory: OSV:PYSEC-2026-1043...

dragonn (0.4.2), dream-on-gym (0.0.1) +5 more potentially affected by CVE-2022-35937 via tensorflow-gpu (1.15.0)

tensorflow-gpu PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - dragonn 0.4.2 - dream-on-gym 0.0.1 - ml4a =0.1.0, =0.0.3, =0.3.0, =0.9.0, =0.0.5, =0.0.88 Source cves: CVE-2022-35937 Source...

dragonn (0.4.2), dream-on-gym (0.0.1) +5 more potentially affected by CVE-2022-35987 via tensorflow-gpu (1.15.0)

tensorflow-gpu PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - dragonn 0.4.2 - dream-on-gym 0.0.1 - ml4a =0.1.0, =0.0.3, =0.3.0, =0.9.0, =0.0.5, =0.0.88 Source cves: CVE-2022-35987 Source...

dragonn (0.4.2), dream-on-gym (0.0.1) +5 more potentially affected by CVE-2022-35939 via tensorflow-gpu (1.15.0)

tensorflow-gpu PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - dragonn 0.4.2 - dream-on-gym 0.0.1 - ml4a =0.1.0, =0.0.3, =0.3.0, =0.9.0, =0.0.5, =0.0.88 Source cves: CVE-2022-35939 Source...

vcap (>=0.2.4.dev13, <=0.3.1) potentially affected by CVE-2022-36027 via tensorflow-gpu (1.15.4)

tensorflow-gpu PYPI version 1.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - vcap =0.2.4.dev13, =0.3.1 Source cves: CVE-2022-36027 Source advisory: OSV:PYSEC-2026-965...