CVE-2019-6446

CVE-2019-6446 Numpy反序列化命令执行 NumPy是一个功能强大的Python库，主要用于对多维数组执行计算。大佬们分析称其版本小于等于1.16.0存在该漏洞，修复建议是删除lib/npyio.py中load函数的参数allowpickle或将其值改为False就可以避免反序列化问题；在测试1.16.3（Mac/Windows）版本该load函数移除了allowpickle参数。但依旧存在命令执行。 测试时最新版本为1.16.3 Reference:https://mp.weixin.qq.com/s/9qwTTtQdpIjH8f0CcDYs6g...

numpy-1.13.1

Travis CI 状态 --- NumPy 是使用 Python 进行科学计算所需的基础包。 该包包含： 一个强大的 N 维数组对象 复杂的（广播）函数 用于集成 C/C++ 和 Fortran 代码的工具 有用的线性代数、傅里叶变换和随机数生成能力。 它源自旧的 Numeric 代码库，可以用作 Numeric 的替代品。它还增加了 numarray 引入的功能，可以用来替代 numarray。 更多信息可以在网站上找到： http://www.numpy.org 安装后，如果已安装 nose，可以通过以下命令运行测试： python -c 'import numpy;...

Rocky Linux 8.6 [CIQ] Security Update: python39-numpy / python39-numpy-debuginfo / python39-numpy-doc / etc Multiple Vulnerabilities (ciqsa-2026_0771)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260771 advisory. This advisory aggregates security fixes for the numpy SRPM in CIQ LTS 8.6. It addresses 4 CVEs: CVE-2015-20107, CVE-2020-10735, CVE-2021-28861,...

Rocky Linux 8 [CIQ] Security Update: python3-numpy / python3-numpy-debuginfo / python3-numpy-f2py (crlsa-2019_3704)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20193704 advisory. numpy: crafted serialized object passed in numpy.load in pickle python module allows arbitrary code execution CVE-2019-6446 Tenable has extracted the preceding...

Rocky Linux 8.6 [CIQ] Security Update: python39-numpy / python39-numpy-debuginfo / python39-numpy-doc / etc (ciqsa-2026_0232)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260232 advisory. This advisory aggregates security fixes for the numpy SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2021-28861. Tenable has extracted the preceding description blo...

Rocky Linux 8.6 [CIQ] Security Update: python38-numpy / python38-numpy-debuginfo / python38-numpy-doc / etc Multiple Vulnerabilities (ciqsa-2026_0209)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260209 advisory. This advisory aggregates security fixes for the numpy SRPM in CIQ LTS 8.6. It addresses 4 CVEs: CVE-2015-20107, CVE-2020-10735, CVE-2021-28861,...

CLIPGuard

CLIPGuard Instalación 1. Crear entorno virtual recomendado python -m venv clipguardenv source clipguardenv/bin/activate 2. Instalar PyTorch ejemplo con CUDA pip install torch torchvision --index-url https://download.pytorch.org/whl/cu121 Para CPU: pip install torch torchvision 3. Instalar...

Improper Check for Unusual or Exceptional Conditions

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the disaggregated serving endpoint /inference/v1/generate in...

psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

Summary PSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

GHSA-8Q6G-VJHF-JP8M psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

Summary PSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

CVE-2026-59991 psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CLSA-2026-1789542174 TuxCare security update for numpy (1 CVE)

TuxCare rebuilt numpy to address 1 CVE. Fixed in 1.15.4.post4+tuxcare...

CLSA-2026-1789474848 TuxCare security update for numpy (1 CVE)

TuxCare rebuilt numpy to address 1 CVE. Fixed in 1.15.4.post3+tuxcare...

CLSA-2026-1789467688 TuxCare security update for numpy (1 CVE)

TuxCare rebuilt numpy to address 1 CVE. Fixed in 1.16.0.post4+tuxcare...

CLSA-2026-1789381947 TuxCare security update for numpy (2 CVEs)

TuxCare rebuilt numpy to address 2 CVEs. Fixed in 1.16.0.post3+tuxcare...

[SECURITY] Fedora 45 Update: python-asteval-1.0.10-1.fc45

ASTEVAL is a safeish evaluator of Python expressions and statements, using Python's ast module. The idea is to provide a simple, safe, and robust miniature mathematical language that can handle user-input. The emphasis here is on mathematical expressions, and so many functions from numpy are...

CVE-2026-68513 OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 contain a heap buffer overflow in PyOpenEXR triggered by a channel-name key collision between literal and prefixed...

EUVD-2026-65736

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 contain a heap buffer overflow in PyOpenEXR triggered by a channel-name key collision between literal and prefixed...

CVE-2026-68513

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 contain a heap buffer overflow in PyOpenEXR triggered by a channel-name key collision between literal and prefixed...

CVE-2026-68513

CVE-2026-68513 is a heap buffer overflow in PyOpenEXR (the Python binding of the OpenEXR library). When separate_channels=false, the channelNameToRGBA() function coalesces channel results into a shared RGB array. A crafted flat scanline EXR file containing both a literal channel name (e.g., left)...