Keras TorchModuleWrapper Code Execution

The vulnerability of the TorchModuleWrapper.fromconfig function in the Keras library is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

FLEX 5000 I/O Heap Overflow DoS

The vulnerability of the microprogrammed input/output module software of the FLEX 5000 is related to the repeated release of memory. Exploiting this vulnerability could allow a malicious actor to cause service failure by sending specially crafted CIP packets...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1962)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1962 advisory. When using the tarfile module with a file opened in streaming mode mode=r| the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. CVE-2026-11972 Tenable has...

Linux Distros Unpatched Vulnerability : CVE-2026-63993

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached iphdr value after skbtunnelcheckpmtu skbtunnelcheckpmtu can chang...

Linux Distros Unpatched Vulnerability : CVE-2026-64076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: bridge: ebtables: close module init race sashiko reports for unrelated patch: Does the core ebtables initialization in ebtables.c suffer from a simil...

TencentOS Server 2: perl-IO-Compress (TSSA-2026:0652)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0652 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-64018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rxreqidx to prevent out-of-bounds array access In manahwcrxeventhandler,...

Linux Distros Unpatched Vulnerability : CVE-2026-64162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is...

IBM Langflow OSS code injection vulnerability (CNVD-2026-31205)

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...

PT-2026-61715

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.4.3 Description rsync is a file-copying tool utilizing a delta-transfer algorithm to synchronize files. A symlink race condition exists in path-based system calls such as chmod and chown, as previous fixes for open...

PT-2026-61538

Name of the Vulnerable Software and Affected Versions Dancer2 versions prior to 2.1.0 Description Insecure session IDs are generated when Cryptographically Secure Pseudo-Random Number Generator CSPRNG modules are unavailable. The function generate id in Dancer2::Core::Role::SessionFactory silentl...

CVE-2026-45270: Improper Neutralization of Input During Web Page Generation

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Pages backend module registers the htmlpurify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages Home::index ...

PT-2026-61612

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.9c ProFTPD versions prior to 1.3.10rc3 Description A signed integer overflow exists in the mod sftp module's SCP size-record parser. Authenticated low-privilege attackers can bypass ASLR Address Space Layout...

kernel security update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...

GHSA-V2W2-W228-C444 Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...

DEBIAN-CVE-2026-12484

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...

CVE-2026-12484 Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...

SUSE CVE-2026-53382

In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix NULL pointer dereference in vidtvmuxpushsi syzbot reported a general protection fault in vidtvpsitspsiwriteinto 1. vidtvmuxgetpidctx can return NULL, but vidtvmuxpushsi does not check for this before dereferenci...

AZL-92805 CVE-2026-64076 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: ebtables: close module init race sashiko reports for unrelated patch: Does the core ebtables initialization in ebtables.c suffer from a similar race? Once nfregistersockopt completes, the sockopts are exposed...