1260 matches found
GHSA-36FQ-JGMW-4R9C vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
GHSA-29GW-9793-FVW7 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
CVE-2025-9906 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
CVE-2023-24816 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
CVE-2026-45804
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.frompretrained flow can bypass the trustremotecode guard because download validates modelindex.json and custom pipeline code before later loading from a cached folder that can change, allowin...
EUVD-2026-44711
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.frompretrained flow can bypass the trustremotecode guard because download validates modelindex.json and custom pipeline code before later loading from a cached folder that can change, allowin...
Upwind Finds Coordinated Supply Chain Campaign Compromising Multiple AsyncAPI npm Packages
Upwind links compromised AsyncAPI npm packages to a coordinated supply chain attack spanning repositories, publishing pipelines, and developer systems at risk...
Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check
SummaryThe RegexMatching check in the giskard-checks package passes a user-supplied regular expression pattern directly to Python's re.search without any timeout, complexity guard, or pattern validation. An attacker who can control the regex pattern or the text being matched can craft inputs that...
PYSEC-2026-2661 MLflow has a command injection in mlflow/sagemaker/__init__.py
A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the mlflow/sagemaker/init.py file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, whic...
PYSEC-2026-1721 open-webui allows writing and deleting arbitrary files
In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHEDIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote cod...
CVE-2025-71369
picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder.basichandlers in reduce methods, allowing attackers to bypass safety checks. Remote attackers can embed undetected malicious code in pickle files that executes during deserialization,...
CVE-2026-42295 vulnerabilities
Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...
GHSA-7VF8-2CR6-54MF vulnerabilities
Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...
CVE-2026-42297 vulnerabilities
Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...
GHSA-P4GQ-3VXJ-F4JQ vulnerabilities
Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...
GHSA-XCHC-CQWG-G76Q vulnerabilities
Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...
CVE-2026-42183 vulnerabilities
Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...
CVE-2026-42183 vulnerabilities
Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines, argo-workflows, kubeflow-pipelines-driver-fips, kubeflow-pipelines-fips...