faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2026-2614 via mlflow (1.7.2)

mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2026-2614 Source advisory: OSV:PYSEC-2026-2654...

pytorch-segmentation-models-trainer (0.11.0) potentially affected by CVE-2026-31221 via pytorch-lightning (1.4.3)

pytorch-lightning PYPI version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.11.0 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...

pytorch-segmentation-models-trainer (0.7.0), ratsnlp (0.0.9993) potentially affected by CVE-2026-31221 via pytorch-lightning (1.3.7)

pytorch-lightning PYPI version 1.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.7.0 - ratsnlp 0.0.9993 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...

chemprobe (0.1.5), finetuning-scheduler (0.3.3) +1 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.8.4)

pytorch-lightning PYPI version 1.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - chemprobe 0.1.5 - finetuning-scheduler 0.3.3 - uncertainty-estimation-models 0.1.0 Source cves: CVE-2026-31221 Source advisory...

eargait (3.0.0), pytorch-segmentation-models-trainer (>=0.16.0, <=0.16.1) potentially affected by CVE-2026-31221 via pytorch-lightning (1.5.3)

pytorch-lightning PYPI version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - eargait 3.0.0 - pytorch-segmentation-models-trainer =0.16.0, =0.16.1 Source cves: CVE-2026-31221 Source advisory:...

finetuning-scheduler (0.2.1), nlhappy (2022.9.14) +1 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.7.1)

pytorch-lightning PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - finetuning-scheduler 0.2.1 - nlhappy 2022.9.14 - pytorch-segmentation-models-trainer 0.17.0 Source cves: CVE-2026-31221 Source...

paoding (0.1.1), pytorch-segmentation-models-trainer (0.12.0) potentially affected by CVE-2026-31221 via pytorch-lightning (1.4.8)

pytorch-lightning PYPI version 1.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - paoding 0.1.1 - pytorch-segmentation-models-trainer 0.12.0 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...

pytorch-segmentation-models-trainer (0.15.0) potentially affected by CVE-2026-31221 via pytorch-lightning (1.5.2)

pytorch-lightning PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.15.0 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...

Open WebUI's Model Import Overwrites Any Model Without Ownership Check

Model Import Overwrites Any Model Without Ownership Check Affected ComponentModel import endpoint:- backend/openwebui/routers/models.py lines 254-308, importmodels Affected VersionsCurrent main branch commit 6fdd19bf1 and likely all versions with model import functionality. DescriptionThe POST...

PYSEC-2026-2749 Open WebUI's Model Import Overwrites Any Model Without Ownership Check

Model Import Overwrites Any Model Without Ownership Check Affected Component Model import endpoint: - backend/openwebui/routers/models.py lines 254-308, importmodels Affected Versions Current main branch commit 6fdd19bf1 and likely all versions with model import functionality. Description The POS...

PYSEC-2026-2734 Open WebUI's responses passthrough endpoint lacks access control authorization

Summary The /responses endpoint in the OpenAI router accepts any authenticated user and forwards requests directly to upstream LLM providers without enforcing per-model access control. While the primary chat completion endpoint generatechatcompletion checks model ownership, group membership, and...

PYSEC-2026-2719 Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining

Base Model Routing Bypasses Access Control via Model Chaining Affected Component Model chaining via basemodelid: - backend/openwebui/routers/models.py lines 170-214, createnewmodel - backend/openwebui/routers/models.py lines 254-308, importmodels - backend/openwebui/main.py lines 1696-1711, base...

InstructLab Includes Functionality from Untrusted Control Sphere

A flaw was found in InstructLab. The linuxtrain.py script hardcodes trustremotecode=True when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run ilab train/download/generate with a specially crafted malicious model...

PYSEC-2026-2522 InstructLab Includes Functionality from Untrusted Control Sphere

A flaw was found in InstructLab. The linuxtrain.py script hardcodes trustremotecode=True when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run ilab train/download/generate with a specially crafted malicious model...

faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2025-15381 via mlflow (1.7.2)

mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2025-15381 via mlflow (1.2.0)

mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2025-15031 via mlflow (1.2.0)

mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2025-15031 Source advisory: OSV:PYSEC-2026-2656...

faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2025-15031 via mlflow (1.7.2)

mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2025-15031 Source advisory: OSV:PYSEC-2026-2656...

faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2025-14287 via mlflow (1.2.0)

mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2025-14287 Source advisory: OSV:PYSEC-2026-2661...

faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2025-14287 via mlflow (1.7.2)

mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2025-14287 Source advisory: OSV:PYSEC-2026-2661...