7218 matches found
TensorFlow vulnerable to Out-of-Bounds Read in GRUBlockCellGrad
ImpactOut of bounds read in GRUBlockCellGradpythonfunc = tf.rawops.GRUBlockCellGradpara = 'x': 21.1, 156.2, 83.3, 115.4, 'hprev': array136.5, 136.6, 'wru': array26.7, 0.8, 47.9, 26.1, 26.2, 26.3, 'wc': array 0.4, 31.5, 0.6, 'bru': array0.1, 0.2 , dtype=float32, 'bc': 0x41414141, 'r': array0.3, 0....
OpenStack Cinder, glance, and Nova vulnerable to Path Traversal
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, a...
Tensorflow vulnerable to Out-of-Bounds Read
ImpactWhen the BaseCandidateSamplerOp function receives a value in trueclasses larger than rangemax, a heap oob vuln occurs.pythontf.rawops.ThreadUnsafeUnigramCandidateSampler trueclasses=0x100000,1, numtrue = 2, numsampled = 2, unique = False, rangemax = 2, seed = 2, seed2 = 2 PatchesWe have...
Heap overflow in `QuantizeAndDequantizeV2`
ImpactThe function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered.pythonimport tensorflow as [email protected] test:...
Invalid char to bool conversion when printing a tensor
ImpactWhen printing a tensor, we get it's data as a const char array since that's the underlying storage and then we typecast it to the element type. However, conversions from char to bool are undefined if the char is not 0 or 1, so sanitizers/fuzzers will crash. PatchesWe have patched the issue ...
Out of bounds write in grappler in Tensorflow
ImpactThe function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. PatchesWe have patched the issue in GitHub commit...
Segfault in `tf.raw_ops.TensorListConcat`
ImpactIf tf.rawops.TensorListConcat is given elementshape=, it results segmentation fault which can be used to trigger a denial of service attack.pythonimport tensorflow as tftf.rawops.TensorListConcat inputhandle=tf.data.experimental.tovarianttf.data.Dataset.fromtensorslices1, 2, 3,...
TensorFlow vulnerable to `CHECK` fail in `Save` and `SaveSlices`
ImpactIf Save or SaveSlices is run over tensors of an unsupported dtype, it results in a CHECK fail that can be used to trigger a denial of service attack.pythonimport tensorflow as tffilename = tf.constant""tensornames = tf.constant"" Savedata = tf.casttf.random.uniformshape=1, minval=-10000,...
Seg fault in `ndarray_tensor_bridge` due to zero and large inputs
ImpactIf a numpy array is created with a shape such that one element is zero and the others sum to a large number, an error will be raised. E.g. the following raises an error:pythonnp.ones0, 231, 231An example of a proof of concept:pythonimport numpy as npimport tensorflow as tfinputval =...
TensorFlow vulnerable to `CHECK` fail in `tf.linalg.matrix_rank`
ImpactWhen tf.linalg.matrixrank receives an empty input a, the GPU kernel gives a CHECK fail that can be used to trigger a denial of service attack.pythonimport tensorflow as tfa = tf.constant, shape=0, 1, 1, dtype=tf.float32tf.linalg.matrixranka=a PatchesWe have patched the issue in GitHub commi...
TensorFlow vulnerable to segfault in `QuantizedAvgPool`
ImpactIf QuantizedAvgPool is given mininput or maxinput tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfksize = 1, 2, 2, 1strides = 1, 2, 2, 1padding = "SAME"input = tf.constant1, shape=1,4,4,2,...
TensorFlow vulnerable to segfault in `QuantizedAdd`
ImpactIf QuantizedAdd is given mininput or maxinput tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfToutput = tf.qint32x = tf.constant140, shape=1, dtype=tf.quint8y = tf.constant26, shape=10, dtype=tf.quint8mi...
TensorFlow vulnerable to `CHECK` fail in `TensorListScatter` and `TensorListScatterV2`
ImpactWhen TensorListScatter and TensorListScatterV2 receive an elementshape of a rank greater than one, they give a CHECK fail that can trigger a denial of service attack.pythonimport tensorflow as tfarg0=tf.random.uniformshape=2, 2, 2, dtype=tf.float16, maxval=Nonearg1=tf.random.uniformshape=2,...
TensorFlow vulnerable to `CHECK` failure in `TensorListReserve` via missing validation
ImpactIn core/kernels/listkernels.cc's TensorListReserve, numelements is assumed to be a tensor of size 1. When a numelements of more than 1 element is provided, then tf.rawops.TensorListReserve fails the CHECKEQ in CheckIsAlignedAndSingleElement.pythonimport tensorflow as...
TensorFlow vulnerable to segfault in `Requantize`
ImpactIf Requantize is given inputmin, inputmax, requestedoutputmin, requestedoutputmax tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfouttype = tf.quint8input = tf.constant1, shape=3, dtype=tf.qint32inputmin...
PYSEC-2026-3448
Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-controlled endpoints and read arbitrary environment variables. Attackers can exploit the unauthenticated /md, /llm, and /llm/job endpoints by...
Undefined behavior when users supply invalid resource handles
ImpactMultiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid:pythonimport tensorflow as tftf.rawops.QueueIsClosedV2handle=pythonimport tensorflow as tftf.summary.flushwriter= In graph mode, it would have been impossible to perform these API...
Undefined behavior when users supply invalid resource handles
ImpactMultiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid:pythonimport tensorflow as tftf.rawops.QueueIsClosedV2handle=pythonimport tensorflow as tftf.summary.flushwriter= In graph mode, it would have been impossible to perform these API...
Missing validation causes denial of service via `LSTMBlockCell`
ImpactThe implementation of tf.rawops.LSTMBlockCell does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tftf.rawops.LSTMBlockCell x=tf.constant0.837607, shape=28,29, dtype=tf.float32,...
Missing validation causes denial of service via `StagePeek`
ImpactThe implementation of tf.rawops.StagePeek does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tfindex = tf.constant, shape=0, dtype=tf.int32tf.rawops.StagePeekindex=index,...
Insecure temporary file in Tensorflow
ImpactIn multiple places, TensorFlow uses tempfile.mktemp to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in mktemp and the actual creation of the file by a...
Out of bounds write in TFLite
Impact An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions. PatchesWe have patched th...
Null pointer dereference in TensorFlow
ImpactWhen building an XLA compilation cache, if default settings are used, TensorFlow triggers a null pointer dereference:cc string allowedgpus = flr-configproto-gpuoptions.visibledevicelist; In the default scenario, all devices are allowed, so flr-configproto is nullptr. PatchesWe have patched...
Integer overflows in Tensorflow
Impact The implementations of SparseCwise ops are vulnerable to integer overflows. These can be used to trigger large allocations so, OOM based denial of service or CHECK-fails when building new TensorShape objects so, assert failures based denial of service:pythonimport tensorflow as tfimport...
Uninitialized variable access in Tensorflow
ImpactThe implementation of AssignOp can result in copying unitialized data to a new tensor. This later results in undefined behavior.The implementation has a check that the left hand side of the assignment is initialized to minimize number of allocations, but does not check that the right hand...
Integer overflow in TensorFlow
ImpactUnder certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior. PatchesWe have patched the issue in GitHub commit...
Memory leak in decoding PNG images
ImpactWhen decoding PNG images TensorFlow can produce a memory leak if the image is invalid.After calling png::CommonInitDecode..., , the decode value contains allocated buffers which can only be freed by calling png::CommonFreeDecode. However, several error case in the function implementation...
Out of bounds read in Tensorflow
Impact The implementation of shape inference for ReverseSequence does not fully validate the value of batchdim and can result in a heap OOB read:pythonimport tensorflow as [email protected] test: y = tf.rawops.ReverseSequence input = 'aaa','bbb', seqlengths = 1,1,1, seqdim = -10, batchdim = -10...
Out-of-bounds Write in OpenCV
An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0 corresponds with OpenCV-Python 4.1.0.25. A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An...
Divide By Zero in OpenCV.
An issue was discovered in OpenCV 4.1.0 OpenCV-Python 4.1.0.25. There is a divide-by-zero error in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp...
Integer Overflow or Wraparound in OpenCV
In opencv/modules/imgcodecs/src/grfmtpxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 corresponding with OpenCV-Python version 3.3.0.9 and...
Improper Input Validation in OpenCV
OpenCV 3.0.0 allows remote attackers to cause a denial of service segfault via vectors involving corrupt chunks. This issue was fixed in OpenCV version 3.3.1 corresponding to OpenCV 3.3.1.11...
PYSEC-2026-2215
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise...
PYSEC-2026-2210
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from ea...
Home Assistant Core before is vulnerable to Directory Traversal
Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation, leaving a path traversal vulnerability...
Dosage vulnerable to a Directory Traversal through crafted HTTP responses
ImpactWhen downloadinging comic images, Dosage constructs target file names from different aspects of the remote comic page URL, image URL, page content, etc.. While the basename is properly stripped of directory-traversing characters, the file extension is taken from the HTTP Content-Type header...
Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion
While testing Litestar's RateLimitMiddleware, I discovered that rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. The ProblemLitestar's RateLimitMiddleware uses cachekeyfromrequest to...
DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables
The DataChain library reads serialized objects from environment variables such as DATACHAINMETASTORE and DATACHAINWAREHOUSE in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads...
ml-logger deserialization vulnerability
A vulnerability was determined in geyang ml-logger 0.10.36 and prior. Affected is the function loghandler of the file mllogger/server.py of the component Ping Handler. This manipulation of the argument data causes deserialization. It is possible to initiate the attack remotely. The exploit has be...
Hugging Face Transformers library has Regular Expression Denial of Service
A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically within the normalizenumbers method of the EnglishNormalizer class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises fro...
pip's fallback tar extraction doesn't check symbolic links point to extraction directory
When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python versi...
llama-index-core insecurely handles temporary files
The llama-index-core package, up to version 0.12.44, contains a vulnerability in the getcachedir function where a predictable, hardcoded directory path /tmp/llamaindex is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal...
Neo4j Cypher MCP server is vulnerable to DNS rebinding
ImpactDNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend...
Infrahub: Deleted and expired API tokens can still authenticate
ImpactA bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. PatchesThis issue is fixed in versions 1.3.9 and 1.4.5 WorkaroundsUser...
Fides has a Lack of Brute-Force Protections on Authentication Endpoints
SummaryThe Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testing attacks, such as credential stuffing or passwo...
Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file
ImpactAn out-of-bounds read was found in Exiv2 versions v0.28.5 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image fil...
Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip
SummaryUsing idlelib.calltip.Calltip.fetchtip, which is a built-in python library function to execute remote pickle file. DetailsThe attack payload executes in the following steps:First, the attacker craft the payload by calling to idlelib.calltip.Calltip.fetchtip function in reduce methodThen wh...
uv allows ZIP payload obfuscation through parsing differentials
ImpactIn versions 0.8.5 and earlier of uv, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. This enabled two parser differentials against other Python package installers:1. An attacker could contrive a ZIP...
Bugsink path traversal via event_id in ingestion
SummaryIn affected versions, ingestion paths construct file locations directly from untrusted eventid input without validation. A specially crafted eventid can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations.Submitting such...
OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode
SummaryWhen reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereference in a write operation. DetailsIn the ScanLineProcess::runfillfunction, implemented in src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp,...