PT-2026-59778

Impact The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. Patches We have patched the issue in GitHub commit...

PT-2026-59866

Impact tf.raw ops.DynamicStitch specifies input sizes when it is registered. cpp REGISTER OP"DynamicStitch" .Input"indices: N int32" .Input"data: N T" .Output"merged: T" .Attr"N : int = 1" .Attr"T : type" .SetShapeFnDynamicStitchShapeFunction; When it receives a differing number of inputs, such a...

PT-2026-59891

Impact When SparseSparseMaximum is given invalid sparse tensors as inputs, it can give an NPE. python import tensorflow as tf tf.raw ops.SparseSparseMaximum a indices=1, a values = 0.1 , a shape = 2, b indices=, b values =2 , b shape = 2, Patches We have patched the issue in GitHub commit...

PT-2026-59794

Impact Eig can be fed an incorrect Tout input, resulting in a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf import numpy as np arg 0=tf.constantvalue=np.random.randomsize=2, 2, shape=2, 2, dtype=tf.float32 arg 1=tf.complex128 arg 2=True arg 3='' tf.raw...

CVE-2026-49851 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, jupyter-base-notebook...

GHSA-QCQ2-496W-V96P vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, jupyter-base-notebook...

GHSA-QCQ2-496W-V96P vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, jupyter-base-notebook, tensorflow-cpu-jupyter...

CVE-2026-49851 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, jupyter-base-notebook, tensorflow-cpu-jupyter...

PYSEC-2026-3171 TensorFlow vulnerable to OOB write in `scatter_nd` in TF Lite

Impact The ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. Patches We have patched the issue in GitHub commit...

PYSEC-2026-3316 TensorFlow vulnerable to `CHECK` failure in tf.reshape via overflows

Impact The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure caused by overflowing the number of elements in a tensor: python import tensorflow as tf tf.reshapetensor=1,shape=tf.constant0 for i in range255, dtype=tf.int64 This i...

PYSEC-2026-3226 TensorFlow vulnerable to OOB read in `Gather_nd` in TF Lite

Impact The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. Patches We have patched the issue in GitHub commit...

PYSEC-2026-3220 TensorFlow vulnerable to `CHECK` fail in `tf.sparse.cross`

Impact If tf.sparse.cross receives an input separator that is not a scalar, it gives a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf tf.sparse.crossinputs=,name='a',separator=tf.constant'a', 'b',dtype=tf.string Patches We have patched the issue ...

TensorFlow vulnerable to `CHECK` failure in tf.reshape via overflows

ImpactThe implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure caused by overflowing the number of elements in a tensor:pythonimport tensorflow as tftf.reshapetensor=1,shape=tf.constant0 for i in range255, dtype=tf.int64This is...

TensorFlow vulnerable to OOB write in `scatter_nd` in TF Lite

ImpactThe ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. PatchesWe have patched the issue in GitHub commit...

TensorFlow vulnerable to `CHECK` failure in `SobolSample` via missing validation

ImpactThe implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure assertion failure caused by assuming input0, input1, and input2 to be scalar.pythonimport tensorflow as tftf.rawops.SobolSampledim=tf.constant1,0, numresults=tf.constant1, skip=tf.constant1 PatchesWe...

TensorFlow vulnerable to OOB write in `scatter_nd` in TF Lite

ImpactThe ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. PatchesWe have patched the issue in GitHub commit...

TensorFlow vulnerable to `CHECK` fail in `tf.sparse.cross`

ImpactIf tf.sparse.cross receives an input separator that is not a scalar, it gives a CHECK fail that can be used to trigger a denial of service attack.pythonimport tensorflow as tftf.sparse.crossinputs=,name='a',separator=tf.constant'a', 'b',dtype=tf.string PatchesWe have patched the issue in...

TensorFlow vulnerable to `CHECK` fail in `tf.sparse.cross`

ImpactIf tf.sparse.cross receives an input separator that is not a scalar, it gives a CHECK fail that can be used to trigger a denial of service attack.pythonimport tensorflow as tftf.sparse.crossinputs=,name='a',separator=tf.constant'a', 'b',dtype=tf.string PatchesWe have patched the issue in...

PYSEC-2026-3144 TensorFlow vulnerable to `CHECK` failure in `SobolSample` via missing validation

Impact The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure assertion failure caused by assuming input0, input1, and input2 to be scalar. python import tensorflow as tf tf.rawops.SobolSampledim=tf.constant1,0, numresults=tf.constant1, skip=tf.constant1 Patche...

PYSEC-2026-3302 TensorFlow vulnerable to `CHECK` failure in `SobolSample` via missing validation

Impact The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure assertion failure caused by assuming input0, input1, and input2 to be scalar. python import tensorflow as tf tf.rawops.SobolSampledim=tf.constant1,0, numresults=tf.constant1, skip=tf.constant1 Patche...