PT-2026-61129

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A race condition in the F2FS Flash-Friendly File System implementation can lead to list corruption and kernel panics, particularly when the F2FS partition is nearly full. The issue occur...

finetuning-scheduler (0.1.2), gts-engine (>=0.1.1, <=0.1.2) +3 more potentially affected by CVE-2026-58659 via pytorch-lightning (1.6.2)

pytorch-lightning PYPI version 1.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - finetuning-scheduler 0.1.2 - gts-engine =0.1.1, =0.3.3, =0.1.0, =0.1.5 Source cves: CVE-2026-58659 Source advisory:...

lightning-flash (>=0.1.0, <=0.2.1) potentially affected by CVE-2026-58659 via pytorch-lightning (1.2.0rc0)

pytorch-lightning PYPI version 1.2.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - lightning-flash =0.1.0, =0.2.1 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

stellaswap-v040-poc

PoC V-040 — Flash-vote Bribe Theft en StellaSwap Proof of...

Symlink Attack

Overview flash-attention is a Flash Attention2 operator on Huawei Ascend 910A. Affected versions of this package are vulnerable to Symlink Attack via the downloadandcopy function in hopper/setup.py when extracting archives without validating symlinks or filtering tar members. An attacker can...

lightning-flash (>=0.1.0, <=0.2.1) potentially affected by CVE-2026-31221 via pytorch-lightning (1.2.0rc0)

pytorch-lightning PYPI version 1.2.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - lightning-flash =0.1.0, =0.2.1 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...

airoboros (>=2.1.6, <=2.2.1), bhasa (>=0.1.0, <=0.1.1) +19 more potentially affected by CVE-2026-31253 via flash-attn (>=2.0.8, <=2.8.3)

flash-attn PYPI version =2.0.8, =2.1.6, =0.1.0, =0.1.0, =0.0.5, =0.1.0, =0.2.0rc2, =0.0.1, =0.3.6.post1, =0.1.8, =0.0.1.post1, =0.0.2 and more Source cves: CVE-2026-31253 Source advisory: OSV:PYSEC-2026-2477...

flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism

The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 2025-13-04 contains an insecure deserialization vulnerability CWE-502 in its checkpoint loading mechanism. The loadcheckpoint function in checkpoint.py and the checkpoint loading code in eval.py use...

ochat (3.1.0) potentially affected by CVE-2026-31253 via flash-attn (1.0.9)

flash-attn PYPI version 1.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on flash-attn and may be impacted: - ochat 3.1.0 Source cves: CVE-2026-31253 Source advisory: OSV:PYSEC-2026-2477...

scpert (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-31253 via flash-attn (0.2.8)

flash-attn PYPI version 0.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on flash-attn and may be impacted: - scpert =0.1.0, =0.1.1 Source cves: CVE-2026-31253 Source advisory: OSV:PYSEC-2026-2477...

PYSEC-2026-2477 flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism

The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 2025-13-04 contains an insecure deserialization vulnerability CWE-502 in its checkpoint loading mechanism. The loadcheckpoint function in checkpoint.py and the checkpoint loading code in eval.py use...

ctopt (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-31253 via flash-attn (1.0.4)

flash-attn PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on flash-attn and may be impacted: - ctopt =0.1.0, =0.1.2 Source cves: CVE-2026-31253 Source advisory: OSV:PYSEC-2026-2477...

F2FS Heap Buffer Overflow DoS

The vulnerability of the f2fsrename function in the fs/f2fs/namei.c file of the F2FS file system in the Linux operating system is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Dear Maintainers,I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation. SummaryThe jk parameter is received in pyLoad CNL Blueprint. Due to the lack of j...

PYSEC-2026-1815 Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Dear Maintainers, I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation. Summary The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of...

lightning-flash (>=0.1.0, <=0.2.1) potentially affected by CVE-2024-8020 via pytorch-lightning (1.2.0rc0)

pytorch-lightning PYPI version 1.2.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - lightning-flash =0.1.0, =0.2.1 Source cves: CVE-2024-8020 Source advisory: OSV:PYSEC-2026-1857...

finetuning-scheduler (0.1.2), gts-engine (>=0.1.1, <=0.1.2) +3 more potentially affected by CVE-2024-8020 via pytorch-lightning (1.6.2)

pytorch-lightning PYPI version 1.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - finetuning-scheduler 0.1.2 - gts-engine =0.1.1, =0.3.3, =0.1.0, =0.1.5 Source cves: CVE-2024-8020 Source advisory:...

CVE-2026-10659

The Dhara flash translation layer disk driver drivers/disk/ftldhara.c implemented the dharanand callbacks so that, on a flash error, the error code was written unconditionally through the caller-supplied dharaerrort err pointer e.g. err = DHARAEECC in dharanandread, and similar in...

CVE-2026-10659

The Dhara flash translation layer disk driver drivers/disk/ftldhara.c implemented the dharanand callbacks so that, on a flash error, the error code was written unconditionally through the caller-supplied dharaerrort err pointer e.g. err = DHARAEECC in dharanandread, and similar in...

CVE-2026-10659 NULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resume

The Dhara flash translation layer disk driver drivers/disk/ftldhara.c implemented the dharanand callbacks so that, on a flash error, the error code was written unconditionally through the caller-supplied dharaerrort err pointer e.g. err = DHARAEECC in dharanandread, and similar in...