CVE-2025-14925

CVE-2025-14925 affects Hugging Face Accelerate. The vulnerability stems from improper validation during parsing of checkpoints, enabling deserialization of untrusted data. An attacker can trigger remote code execution by convincing a user to visit a malicious page or open a crafted file, with cod...

CVE-2025-14924 Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability

Hugging Face Transformers megatrongpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in...

CVE-2025-14924

Summary: CVE-2025-14924 affects Hugging Face Transformers megatron_gpt2. The vulnerability arises during the parsing of checkpoints, where user-supplied data is not properly validated, allowing deserialization of untrusted data and resulting in arbitrary code execution in the current process. Imp...

CVE-2025-14929 Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability

Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this...

CVE-2025-14925: Deserialization of Untrusted Data

Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Accelerate. User interaction is required to exploit this vulnerability in that the target...

Hugging Face Transformers 代码问题漏洞

Hugging Face Transformers is a Hugging Face open source framework for defining state-of-the-art machine learning models covering textual, visual, audio, and multimodal models for inference and training. A code issue vulnerability exists in Hugging Face Transformers that stems from a lack of...

CVE-2025-14924: Deserialization of Untrusted Data

Hugging Face Transformers megatrongpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in...

[SECURITY] Fedora 43 Update: checkpointctl-1.4.1-1.fc43

The checkpointctl command can be used for in-depth analysis of container checkpoints created with Podman and Kubernetes...

[SECURITY] Fedora 42 Update: checkpointctl-1.4.1-1.fc42

The checkpointctl command can be used for in-depth analysis of container checkpoints created with Podman and Kubernetes...

(0Day) Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Accelerate. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsin...

(0Day) Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Diffusers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

CVE-2025-64104 LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using direct string concatenation without proper parameterization,...

Insecure Deserialization

monai is vulnerable to Insecure Deserialization. The vulnerability is due to loading of untrusted checkpoint files like torch.load used without safe guards. This allows an attacker to supply a crafted checkpoint that executes arbitrary code during deserialization...

[SECURITY] Fedora 41 Update: checkpointctl-1.4.0-3.fc41

The checkpointctl command can be used for in-depth analysis of container checkpoints created with Podman and Kubernetes...

[SECURITY] Fedora 42 Update: checkpointctl-1.4.0-3.fc42

The checkpointctl command can be used for in-depth analysis of container checkpoints created with Podman and Kubernetes...

[SECURITY] Fedora 43 Update: checkpointctl-1.4.0-3.fc43

The checkpointctl command can be used for in-depth analysis of container checkpoints created with Podman and Kubernetes...

[SECURITY] Fedora 43 Update: checkpointctl-1.4.0-2.fc43

The checkpointctl command can be used for in-depth analysis of container checkpoints created with Podman and Kubernetes...

[SECURITY] Fedora 41 Update: checkpointctl-1.4.0-2.fc41

The checkpointctl command can be used for in-depth analysis of container checkpoints created with Podman and Kubernetes...

PYSEC-2025-141

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. In versions up to and including 1.5.0, in modeldict = torch.loadfullpath, maplocation=torch.devicedevice, weightsonly=True in monai/bundle/scripts.py , weightsonly=True is loaded securely. However, insecure loading method...

CVE-2025-58756 MONAI's unsafe torch usage may lead to arbitrary code execution

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. In versions up to and including 1.5.0, in modeldict = torch.loadfullpath, maplocation=torch.devicedevice, weightsonly=True in monai/bundle/scripts.py , weightsonly=True is loaded securely. However, insecure loading method...