CVE-2026-108947

A deserialization vulnerability exists in yoshitomo-matsubara torchdistill versions up to 1.1.5 . The flaw is located within the load_ckpt function in the torchdistill/common/main_util.py file. An attacker can trigger deserialization by manipulating the src_ckpt argument. This attack requires loc...

EUVD-2026-98206

A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function loadckpt of the file torchdistill/common/mainutil.py. Executing a manipulation of the argument srcckpt can lead to deserialization. The attack needs to be launched locally. The exploit has been...