Malicious code in com.unity.ml-agents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bfceda90642153626d064813e4c0c601ca81d18a6c5fd9e96855cbdee511db13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-21459

Transient DOS while parsing per STA profile in ML IE...

CVE-2025-21459

CVE-2025-21459 affects Qualcomm WLAN components on Qualcomm-based devices. The issue is described as a transient denial-of-service that occurs while parsing per-STA (station) configuration/profile data in the ML IE/WLAN stack. Root cause details are not provided in the supplied documents beyond t...

CVE-2025-21459: Buffer Over-read

Transient DOS while parsing per STA profile in ML IE...

CVE-2025-30390 Azure ML Compute Elevation of Privilege Vulnerability

...

New whitepaper outlines the taxonomy of failure modes in AI agents

We are releasing a taxonomy of failure modes in AI agents to help security professionals and machine learning engineers think through how AI systems can fail and design them with safety and security in mind. The taxonomy continues Microsoft AI Red Team's work to lead the creation of systematizati...

aaa-ml-datasets-course (1.0.0), aait (>=0.0.4.80, <=2.0.2) +2617 more potentially affected by CVE-2025-3730 via torch (>=2.0.0, <=2.7.1)

torch PYPI version =2.0.0, =0.0.4.80, =0.2.1, =1.0.0, =0.1.0, =1.1.0, =0.4.6, =0.0.1, =0.1.0, =1.0.0.3, =0.0.0, =0.0.5.5 and more Source cves: CVE-2025-3730 Source advisory: SNYK:PYTHON-TORCH-9726944...

PYSEC-2025-32

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized...

Malware in @medialink-ml/yuzu-widget

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

aaa-ml-datasets-course (1.0.0), aana (>=0.2.1, <=0.2.2.2) +2115 more potentially affected by CVE-2025-3001 via torch (>=2.0.0, <=2.5.1)

torch PYPI version =2.0.0, =0.2.1, =1.0.0, =0.1.0, =1.1.0, =0.4.6, =0.0.1, =0.0.0, =1.0.1, =2.1.1, =2.3.1 - acscend 1.0.0 - adabmdca 0.1.5 and more Source cves: CVE-2025-3001 Source advisory: OSV:PYSEC-2025-195...

aaa-ml-datasets-course (1.0.0), aait (>=0.0.4.80, <=2.0.2) +3007 more potentially affected by CVE-2025-2999 via torch (>=2.0.0, <=2.9.1)

torch PYPI version =2.0.0, =0.0.4.80, =0.2.1, =1.0.0, =0.1.0, =1.1.0, =0.4.6, =0.0.1, =1.14.0.post1, =0.1.0, =1.0.0.3, =1.0.0.5 and more Source cves: CVE-2025-2999 Source advisory: SNYK:PYTHON-TORCH-10332645...

aaa-ml-datasets-course (1.0.0), aana (>=0.2.1, <=0.2.2.2) +2115 more potentially affected by CVE-2025-3000 via torch (>=2.0.0, <=2.5.1)

torch PYPI version =2.0.0, =0.2.1, =1.0.0, =0.1.0, =1.1.0, =0.4.6, =0.0.1, =0.0.0, =1.0.1, =2.1.1, =2.3.1 - acscend 1.0.0 - adabmdca 0.1.5 and more Source cves: CVE-2025-3000 Source advisory: OSV:PYSEC-2025-194...

ml-deploy (2.0.0), waveletai (>=0.2.5, <=0.2.11) potentially affected by CVE-2025-1474 via mlflow (1.18.0)

mlflow PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-deploy 2.0.0 - waveletai =0.2.5, =0.2.11 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2025-1474 via mlflow (1.29.0)

mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

ml-deploy (2.0.0), waveletai (>=0.2.5, <=0.2.11) potentially affected by CVE-2025-0453 via mlflow (1.18.0)

mlflow PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-deploy 2.0.0 - waveletai =0.2.5, =0.2.11 Source cves: CVE-2025-0453 Source advisory: OSV:GHSA-49M6-VRR9-2CQM...

hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2025-0453 via mlflow (1.29.0)

mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2025-0453 Source advisory: OSV:GHSA-49M6-VRR9-2CQM...

autonomize-ml-observability (>=1.1.0b1, <=1.2.7), autonomize-observer (>=0.0.1, <=0.0.5) +5 more potentially affected by CVE-2025-0453 via mlflow (>=3.0.0rc2, <=3.1.0)

mlflow PYPI version =3.0.0rc2, =1.1.0b1, =0.0.1, =0.1.0, =2.5.0, =0.6.7, =0.0.4, =0.0.9b0 Source cves: CVE-2025-0453 Source advisory: SNYK:PYTHON-MLFLOW-9510841...

hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-8859 via mlflow (1.29.0)

mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-8859 Source advisory: OSV:GHSA-4RQF-8PFM-P36R...

ml-deploy (2.0.0), waveletai (>=0.2.5, <=0.2.11) potentially affected by CVE-2024-8859 via mlflow (1.18.0)

mlflow PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-deploy 2.0.0 - waveletai =0.2.5, =0.2.11 Source cves: CVE-2024-8859 Source advisory: OSV:GHSA-4RQF-8PFM-P36R...

fluoriclogppka (>=0.1.0, <=0.2.7), h2o-wave-ml (>=0.3.0, <=0.5.0) +3 more potentially affected by CVE-2024-8616 via h2o (>=3.18.0.8, <=3.44.0.3)

h2o PYPI version =3.18.0.8, =0.1.0, =0.3.0, =0.4.5, =0.0.1, =0.0.102 - tsanalysis 0.1.0 Source cves: CVE-2024-8616 Source advisory: OSV:GHSA-G48V-3P35-88JR...