GHSA-G7CR-3P24-7WF7 vulnerabilities

Vulnerabilities for packages: nemo-gym, nemo-rl-cuda-13.0, py3-pytorch-cuda-13.0, superset-fips...

GHSA-MRFP-P49P-3HF2 vulnerabilities

Vulnerabilities for packages: nemo-gym, nemo-rl-cuda-13.0, py3-pytorch-cuda-13.0, superset-fips...

CVE-2026-96636 vulnerabilities

Vulnerabilities for packages: nemo-gym, nemo-rl-cuda-13.0, py3-pytorch-cuda-13.0, superset-fips...

CVE-2026-96638 vulnerabilities

Vulnerabilities for packages: nemo-gym, nemo-rl-cuda-13.0, py3-pytorch-cuda-13.0, superset-fips...

CVE-2026-96640 vulnerabilities

Vulnerabilities for packages: nemo-gym, nemo-rl-cuda-13.0, py3-pytorch-cuda-13.0, superset-fips...

CVE-2026-96778 vulnerabilities

Vulnerabilities for packages: nemo-gym, nemo-rl-cuda-13.0, py3-pytorch-cuda-13.0, superset-fips...

GHSA-4RM8-3HMM-39FG vulnerabilities

Vulnerabilities for packages: nemo-gym, nemo-rl-cuda-13.0, py3-pytorch-cuda-13.0, superset-fips...

GHSA-G4QV-2JXX-769H vulnerabilities

Vulnerabilities for packages: nemo-gym, nemo-rl-cuda-13.0, py3-pytorch-cuda-13.0, superset-fips...

GHSA-G842-9RC4-69PW vulnerabilities

Vulnerabilities for packages: nemo-gym, nemo-rl-cuda-13.0, py3-pytorch-cuda-13.0, superset-fips...

GHSA-P8HX-V2P6-RP84 vulnerabilities

Vulnerabilities for packages: nemo-gym, nemo-rl-cuda-13.0, py3-pytorch-cuda-13.0, superset-fips...

GHSA-V9PV-5GC8-W2M6 vulnerabilities

Vulnerabilities for packages: nemo-gym, nemo-rl-cuda-13.0, py3-pytorch-cuda-13.0, superset-fips...

EXPLOIT-CVE-2024-7804

CVE-2024-7804 — PyTorch Distributed RPC Unsafe Deserialization RCE Self-contained lab + exploit for CVE-2024-7804 : remote code execution in PyTorch's distributed RPC framework torch.distributed.rpc through unsafe deserialization of untrusted data CWE-502. Affected: torch Note: this advisory was...

foolbox

home: true heroImage: /logo.png heroText: Foolbox tagline: "Foolbox: attacchi adversarial veloci per valutare la robustezza dei modelli di machine learning in PyTorch, TensorFlow e JAX" actionText: Inizia → actionLink: /guide/ features: title: Prestazioni native details: Foolbox 3 è basata su...

alphafold3-pytorch-lightning-hydra (>=0.2.126, <=0.4.28), cosyvoice-package (0.0.2) +7 more potentially affected by CVE-2026-106440 via hydra-optuna-sweeper (1.2.0)

hydra-optuna-sweeper PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-optuna-sweeper and may be impacted: - alphafold3-pytorch-lightning-hydra =0.2.126, =0.0.1, =0.0.1.dev4, =0.4.0, =2.2.0, =2.9.0 - reverse-distillation 0.1.0...

alphafold3-pytorch-lightning-hydra (>=0.2.126, <=0.4.28), cosyvoice-package (0.0.2) +7 more potentially affected by CVE-2026-106440 via hydra-optuna-sweeper (1.2.0)

hydra-optuna-sweeper PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-optuna-sweeper and may be impacted: - alphafold3-pytorch-lightning-hydra =0.2.126, =0.0.1, =0.0.1.dev4, =0.4.0, =2.2.0, =2.9.0 - reverse-distillation 0.1.0...

alphafold3-pytorch-lightning-hydra (>=0.2.126, <=0.4.28), cosyvoice-package (0.0.2) +7 more potentially affected by CVE-2026-106440 via hydra-optuna-sweeper (1.2.0)

hydra-optuna-sweeper PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-optuna-sweeper and may be impacted: - alphafold3-pytorch-lightning-hydra =0.2.126, =0.0.1, =0.0.1.dev4, =0.4.0, =2.2.0, =2.9.0 - reverse-distillation 0.1.0...

fickling

Fickling Fickling ist ein Dekompilierer, statischer Analysator und Bytecode-Umschreiber für Python-Pickle-Objektserialisierungen. Sie können Fickling verwenden, um bösartige Pickle- oder Pickle-basierte Dateien, einschließlich PyTorch-Dateien, zu erkennen, zu analysieren, reverse zu engineering...

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

Summarylmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with lmdeplo...

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

SummaryLMDeploy's PyTorch DistServe/PD-disaggregation control plane usedrecvpyobj to deserialize messages received through a ZeroMQ PULLsocket. PyZMQ implements recvpyobj using Python pickledeserialization, which can execute arbitrary code while reconstructingan object.The peer address used by th...

PYSEC-2026-4132 Picklescan has a missing detection when calling built-in python profile.Profile.runctx

Summary Using profile.Profile.runctx, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to profile.Profile.runctx function in reduce method Then when the victim...