EUVD-2026-41600

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the raiseforlambdadeserialization function fails to enforce the safe-mode guard when safemode is set to None, which is the default...

CVE-2026-12481

The CVE-2026-12481 entry describes a vulnerability in keras-team/keras 3.14.0 where improper handling of deserialization in the Lambda layer can lead to arbitrary OS‑level code execution. The root cause is in _raise_for_lambda_deserialization(), which does not enforce the safe-mode guard when saf...