EUVD-2026-110046

ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute...

EUVD-2026-110040

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference Old Opsets, Missing Rank Check...

CVE-2026-115921

A flaw was found in Open Neural Network Exchange ONNX. When performing shape inference on a machine learning model, the Scan operator does not safely validate the required numscaninputs attribute. An attacker can exploit this issue by supplying an untrusted model that omits this attribute or...

Linux Distros Unpatched Vulnerability : CVE-2026-115920

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a...

Linux Distros Unpatched Vulnerability : CVE-2026-115919

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN...

CVE-2026-115919

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The...

DEBIAN-CVE-2026-115919

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The...

DEBIAN-CVE-2026-115921

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunctionopset8, and ScanInferenceFunctionopset9 do not safely validate the required numscaninputs attribute. A missing attribute is dereference...

CVE-2026-115920

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernelshape attribute by deriving an empty effectivekernelshape and indexing it...

CVE-2026-115921

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunctionopset8, and ScanInferenceFunctionopset9 do not safely validate the required numscaninputs attribute. A missing attribute is dereference...

UBUNTU-CVE-2026-115919

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The...

CVE-2026-115921

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunctionopset8, and ScanInferenceFunctionopset9 do not safely validate the required numscaninputs attribute. A missing attribute is dereference...

CVE-2026-115920

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernelshape attribute by deriving an empty effectivekernelshape and indexing it...

CVE-2026-115919

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The...

CVE-2026-115922

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, unpack2bit and unpack4bit resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that rawdata or int32data encodes the declared number of elements...

CVE-2026-115921

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunctionopset8, and ScanInferenceFunctionopset9 do not safely validate the required numscaninputs attribute. A missing attribute is dereference...

CVE-2026-115920

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernelshape attribute by deriving an empty effectivekernelshape and indexing it...

CVE-2026-115920

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernelshape attribute by deriving an empty effectivekernelshape and indexing it...

CVE-2026-115919

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The...

CVE-2026-115919

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The...