Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the loadstate function that imports a...

PYSEC-2026-3624

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

PT-2026-60248

Name of the Vulnerable Software and Affected Versions PyTorch Lightning versions prior to 2.6.6 Description A remote code execution issue exists in the load state function. The flaw allows the import and execution of attacker-controlled module names from checkpoint instantiator hyperparameters. A...

FunAudioLLM InspireMusic deserialization vulnerability

A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the function loadstatedict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. The manipulation leads to deserialization. A...

PYSEC-2026-1464 FunAudioLLM InspireMusic deserialization vulnerability

A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the function loadstatedict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. The manipulation leads to deserialization. A...

UBUNTU-CVE-2025-60464

A use-after-free in the gfseiloadfromstateinternal function /filters/seiload.c of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-2 TS file...

CVE-2025-60464

A use-after-free in the gfseiloadfromstateinternal function /filters/seiload.c of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-2 TS file...

The vulnerabilities of the functions rsm_load_state_32() and rsm_load_state_64() in the arch/x86/kvm/emulate.c module of the virtualization subsystem on the x86 kernel of the Linux operating system allow an attacker to gain access to protected information or cause service failures.

The vulnerability of the rsmloadstate32 and rsmloadstate64 functions in the arch/x86/kvm/emulate.c module of the virtualization subsystem on the Linux x86 kernel platform is related to access to memory beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to gain acce...

Deserialization of Untrusted Data

Overview torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the loadstatedict function, used during unpickling. An attacker can corrupt heap memory by convincing a user to...