4391 matches found
CVE-2026-15679 Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this...
CVE-2026-15679
The vulnerability is in timm's checkpoint parsing code, which deserializes untrusted PyTorch checkpoint data without validation, enabling arbitrary code execution in the current process. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). No affected ve...
EUVD-2026-63459
Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this...
CVE-2026-72629
The issue CVE-2026-72629 affects Kibana and allows Authorization Bypass Through User-Controlled Key (CWE-639), enabling unauthorized cross-space access to machine learning model behavior and impacting deployment operations. According to the Elastic advisory, affected versions span all 8.19.0–8.19...
CVE-2026-72671
A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jo...
Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-126)
Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models Description: Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly...
CVE-2026-21400
Protection mechanism failure for some IntelR AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This resul...
CVE-2026-21400
Protection mechanism failure for some IntelR AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This resul...
EUVD-2026-56516
Protection mechanism failure for some IntelR AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This resul...
CVE-2026-21400
CVE-2026-21400 identifies a protection mechanism failure in Intel(R) AI Reference Models before version v3.4.1 when operating in Ring 3 (User Applications). The issue could allow an escalation of privilege where an unprivileged software adversary, with a privileged user and low attack complexity,...
CVE-2026-21400
Protection mechanism failure for some IntelR AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This resul...
PT-2026-70325
Protection mechanism failure for some IntelR AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This resul...
Intel® AI Reference Models Software Advisory
Summary: A potential security vulnerability for some Intel® AI Reference Models software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2026-21400 Description: Protection mechanism failure for some...
CVE-2026-12570
A vulnerability in keras-team/keras versions = 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in keras/src/saving/savinglib.py does not validate the shape or size of datasets, leading...
CVE-2026-12570
A flaw was found in Keras. When loading malicious .keras model files using the keras.models.loadmodel function, the H5IOStore.getitem method does not validate the shape or size of datasets. This can lead to unbounded memory allocation, allowing a malicious actor to trigger an out-of-memory...
EUVD-2026-55002
A vulnerability in keras-team/keras versions = 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in keras/src/saving/savinglib.py does not validate the shape or size of datasets, leading...
Exploit for Use After Free in Linux Linux_Kernel
CVE-2026-23001 – Hugging Face Transformers Model Deserializati...
CVE-2026-44223
A flaw was found in vLLM, an inference and serving engine for large language models LLMs. The extracthiddenstates speculative decoding proposer returns a tensor with an incorrect shape after the first decode step. This can be triggered by a remote attacker sending a request that uses sampling...
CVE-2026-59881 vulnerabilities
Vulnerabilities for packages: awx, py3-cassandra-medusa, datahub-ingestion-fips, lmcache-cuda-12.8, apache-beam-python-3.11-sdk, py3.13-scanner-test-libraries-aiohttp, kserve, dask-kubernetes, apache-beam-python-3.13-sdk, puppygraph-python, open-webui, text-generation-inference,...
GHSA-MQ44-7P77-Q5H7 vulnerabilities
Vulnerabilities for packages: awx, py3-cassandra-medusa, datahub-ingestion-fips, lmcache-cuda-12.8, apache-beam-python-3.11-sdk, py3.13-scanner-test-libraries-aiohttp, kserve, dask-kubernetes, apache-beam-python-3.13-sdk, puppygraph-python, open-webui, text-generation-inference,...