Lucene search
+L
PypaMost viewed

7327 matches found

PyPA
PyPA
added 2026/07/13 2:19 p.m.16 views

TensorFlow vulnerable to assertion fail on MLIR empty edge names

ImpactWhen mlir::tfg::ConvertGenericFunctionToFunctionDef is given empty function attributes, it crashes.cpp// We pre-allocate the array of operands and populate it using the// outputnametoposition and controloutputtoposition populated// previously.SmallVector retvalsfunc.retsize +...

7.5CVSS7AI score0.00579EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.16 views

TensorFlow vulnerable to null-dereference in `mlir::tfg::TFOp::nameAttr`

ImpactWhen mlir::tfg::TFOp::nameAttr receives null type list attributes, it crashes.cppStatusOr GraphDefImporter::ArgNumTypeconst NamedAttrList , const OpDef::ArgDef def, SmallVectorImpl // Check whether a type list attribute is specified. if !argdef.typelistattr.empty if auto v =...

7.5CVSS7AI score0.00591EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.16 views

TensorFlow segfault TFLite converter on per-channel quantized transposed convolutions

ImpactWhen converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process.pythonimport tensorflow as tfclass QuantConv2DTransposedtf.keras.layers.Layer: def buildself, inputshape: self.kernel = self.addweight"kernel", 3, 3,...

7.5CVSS6.9AI score0.00631EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

TensorFlow vulnerable to `CHECK` failure in `SobolSample` via missing validation

ImpactThe implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure assertion failure caused by assuming input0, input1, and input2 to be scalar.pythonimport tensorflow as tftf.rawops.SobolSampledim=tf.constant1,0, numresults=tf.constant1, skip=tf.constant1 PatchesWe...

7.5CVSS6.9AI score0.00467EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

TensorFlow vulnerable to OOB write in `scatter_nd` in TF Lite

ImpactThe ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. PatchesWe have patched the issue in GitHub commit...

9.8CVSS7AI score0.00467EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library

SummaryThe Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. SeverityModerat...

4.7CVSS6.4AI score0.00526EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Incomplete validation in signal ops leads to crashes in TensorFlow

ImpactThe tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes due to CHECK-failures. Patches We have patched the issue in GitHub commit 0a8a781e597b18ead006d19b7d23d0a369e9ad73 merging GitHub PR 55274.The fix will be...

5.5CVSS6.2AI score0.0031EPSS
SaveExploits1References12Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Heap buffer overflow due to incorrect hash function in TensorFlow

ImpactThe TensorKey hash function used total estimated AllocatedBytes, which a is an estimate per tensor, and b is a very poor hash function for constants e.g. int32t. It also tried to access individual tensor bytes through tensor.data of size AllocatedBytes. This led to ASAN failures because the...

5.5CVSS6.2AI score0.00225EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Missing validation results in undefined behavior in `SparseTensorDenseAdd

ImpactThe implementation of tf.rawops.SparseTensorDenseAdd does not fully validate the input arguments:pythonimport tensorflow as tfaindices = tf.constant0, shape=17, 2, dtype=tf.int64avalues = tf.constant, shape=0, dtype=tf.float32ashape = tf.constant6, 12, shape=2, dtype=tf.int64b =...

5.5CVSS6.2AI score0.00338EPSS
SaveExploits1References11Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Missing validation results in undefined behavior in `QuantizedConv2D`

ImpactThe implementation of tf.rawops.QuantizedConv2D does not fully validate the input arguments:pythonimport tensorflow as tfinput = tf.constant1, shape=1, 2, 3, 3, dtype=tf.quint8filter = tf.constant1, shape=1, 2, 3, 3, dtype=tf.quint8 bad argsmininput = tf.constant, shape=0,...

5.5CVSS6.2AI score0.00333EPSS
SaveExploits1References11Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG

An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID...

8.7CVSS7AI score0.0161EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Missing validation causes `TensorSummaryV2` to crash

ImpactThe implementation of tf.rawops.TensorSummaryV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport numpy as npimport tensorflow as tftf.rawops.TensorSummaryV2 tag=np.array'test', tensor=np.array3,...

5.5CVSS6.2AI score0.00317EPSS
SaveExploits1References11Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Tryton vulnerable to arbitrary command execution

The safeeval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in 1 the collection.domain in the webdav module or 2 the formula...

9CVSS7.3AI score0.0216EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

XML Entity Expansion in trytond and proteus

An XML Entity Expansion XEE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. A...

7.5CVSS7AI score0.01957EPSS
SaveExploits0References10Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Zope XSS Vulnerability

Cross-site scripting XSS vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way error messages perform...

6.1CVSS6.5AI score0.01351EPSS
SaveExploits0References13Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Memory leak in Tensorflow

ImpactIf a graph node is invalid, TensorFlow can leak memory in the implementation of ImmutableExecutorState::Initialize:ccStatus s = params.createkerneln-properties, &item-;kernel;if !s.ok item-kernel = nullptr; s = AttachDefs, n; return s; Here, we set item-kernel to nullptr but it is a simple...

5.3CVSS6.2AI score0.00716EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Improper Restriction of XML External Entity Reference in trytond and proteus

An XXE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user...

6.5CVSS6.7AI score0.01396EPSS
SaveExploits1References10Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

`CHECK`-failures during Grappler's `SafeToRemoveIdentity` in Tensorflow

ImpactThe Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a SavedModel such that SafeToRemoveIdentity would trigger CHECK failures. PatchesWe have patched the issue in GitHub commit 92dba16749fae36c246bec3f9ba474d9ddeb7662.The fix will be included in TensorFl...

6.5CVSS6.7AI score0.00821EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Division by zero in Tensorflow

Impact The estimator for the cost of some convolution operations can be made to execute a division by 0:pythonimport tensorflow as [email protected] test: y=tf.rawops.AvgPoolGrad originputshape=1,1,1,1, grad=1.0,1.0,1.0,2.0,2.0,2.0,3.0,3.0,3.0, ksize=1,1,1,1, strides=1,1,1,0, padding='VALID',...

6.8CVSS6.7AI score0.00783EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Reachable Assertion in Tensorflow

ImpactWhen decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow processes. PatchesWe have patched the issue in GitHub...

7.1CVSS6.7AI score0.00469EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Memory exhaustion in Tensorflow

Impact The implementation of StringNGrams can be used to trigger a denial of service attack by causing an OOM condition after an integer overflow:pythonimport tensorflow as tftf.rawops.StringNGrams data='123456', datasplits=0,1, separator='a'15, ngramwidths=, leftpad='', rightpad='', padwidth=-5,...

6.5CVSS6.6AI score0.00821EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Integer overflow in Tensorflow

ImpactThe implementation of Range suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations. PatchesWe have patched the issue in GitHub commit f0147751fd5d2ff23251149ebad9af9f03010732 merging 51733.The fix will be included in TensorFlo...

8.8CVSS7AI score0.00578EPSS
SaveExploits0References10Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Division by zero in TFLite

Impact An attacker can craft a TFLite model that would trigger a division by zero in the implementation of depthwise convolutions.The parameters of the convolution can be user controlled and are also used within a division operation to determine the size of the padding that needs to be added befo...

7.1CVSS6.6AI score0.00821EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Integer overflow in TFLite array creation

Impact An attacker can craft a TFLite model that would cause an integer overflow in TfLiteIntArrayCreate:ccTfLiteIntArray TfLiteIntArrayCreateint size int allocsize = TfLiteIntArrayGetSizeInBytessize; // ... TfLiteIntArray ret = TfLiteIntArraymallocallocsize; // ... The TfLiteIntArrayGetSizeInByt...

8.8CVSS7AI score0.00811EPSS
SaveExploits1References10Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Division by zero in TFLite

Impact An attacker can craft a TFLite model that would trigger a division by zero in BiasAndClamp implementation:ccinline void BiasAndClampfloat clampmin, float clampmax, int biassize, const float biasdata, int arraysize, float arraydata // ... TFLITEDCHECKEQarraysize % biassize, 0; // ... There ...

7.1CVSS6.6AI score0.00757EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Null-dereference in Tensorflow

ImpactWhen decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK:cc const auto attr = attrs.Findarg-s; DCHECKattr != nullptr; if attr-valuecase == AttrValue::kList ...

7.1CVSS6.7AI score0.00992EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Null pointer dereference in Grappler's `IsConstant`

ImpactUnder certain scenarios, Grappler component of TensorFlow can trigger a null pointer dereference. There are 2 places where this can occur, for the same malicious alteration of a SavedModel file fixing the first one would trigger the same dereference in the second place:First, during constan...

6.5CVSS6.7AI score0.01097EPSS
SaveExploits1References11Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Crash when type cannot be specialized in Tensorflow

ImpactUnder certain scenarios, TensorFlow can fail to specialize a type during shape inference:ccvoid InferenceContext::PreInputInit const OpDef& opdef, const std::vector& inputtensors, const std::vector& inputtensorsasshapes const auto ret = fulltype::SpecializeTypeattrs, opdef;...

7.1CVSS6.7AI score0.00992EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Stack overflow in TensorFlow

ImpactThe GraphDef format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a GraphDef containing a fragment such as the following can be consumed when loading a SavedModel: library function signature name: "SomeOp" description:...

7.5CVSS7.1AI score0.00789EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Out of bounds read in Tensorflow

ImpactThe TFG dialect of TensorFlow MLIR makes several assumptions about the incoming GraphDef before converting it to the MLIR-based dialect.If an attacker changes the SavedModel format on disk to invalidate these assumptions and the GraphDef is then converted to MLIR-based IR then they can caus...

8.8CVSS6.2AI score0.00142EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Multiple `CHECK`-fails in `function.cc` in TensowFlow

ImpactA malicious user can cause a denial of service by altering a SavedModel such that assertions in function.cc would be falsified and crash the Python interpreter. PatchesWe have patched the issue in GitHub commits dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2 and...

6.5CVSS6.7AI score0.008EPSS
SaveExploits1References10Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Out of bounds read in Tensorflow

Impact The implementation of Dequantize does not fully validate the value of axis and can result in heap OOB accesses:pythonimport tensorflow as [email protected] test: y = tf.rawops.Dequantize input=tf.constant1,1,dtype=tf.qint32, minrange=1.0, maxrange=10.0, mode='MINCOMBINED', narrowrange=Fals...

8.8CVSS7AI score0.00818EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Out-of-bounds Write in OpenCV.

In OpenCV 3.3.1 corresponding with OpenCV-Python 3.3.1.11, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmtjpeg2000.cpp when parsing a crafted image file...

5.5CVSS6.6AI score0.01507EPSS
SaveExploits1References10Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Out-of-bounds Write in OpenCV

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0 corresponds with OpenCV-Python 4.1.0.25. A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An...

8.8CVSS7.2AI score0.20947EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

`CHECK`-failures during Grappler's `IsSimplifiableReshape` in Tensorflow

ImpactThe Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a SavedModel such that IsSimplifiableReshape would trigger CHECK failures. PatchesWe have patched the issue in GitHub commits ebc1a2ffe5a7573d905e99bd0ee3568ee07c12c1,...

6.5CVSS6.7AI score0.01151EPSS
SaveExploits1References11Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Out-of-bounds Write in OpenCV

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, version 4.1.0 corresponds with OpenCV-Python version 4.1.2.30. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code...

8.8CVSS7.2AI score0.10618EPSS
SaveExploits1References10Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Out-of-bounds Read in OpenCV

OpenCV 4.1.1 has an out-of-bounds read in halbaseline::vload in core/hal/intrinsse.hpp when called from computeSSDMeanNorm in modules/video/src/disflow.cpp...

5.3CVSS6.2AI score0.01662EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Out-of-bounds Read and Out-of-bounds Write in OpenCV

An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1 OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26. There is an out of bounds read/write in the function HaarEvaluator::OptFeature::calc in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service...

7.5CVSS6.6AI score0.0276EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Out-of-bounds Read in OpenCV

An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1 OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26. There is an out of bounds read in the function cv::predictOrdered in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service...

8.2CVSS6.6AI score0.02564EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

NULL Pointer Dereference in OpenCV.

An issue was discovered in OpenCV before 4.1.1 OpenCV-Python before 4.1.1.26. There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src/persistence.cpp...

7.5CVSS6.7AI score0.0337EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV

In modules/imgcodecs/src/grfmtpxm.cpp, the length of buffer AutoBuffer src is small than expected, which will cause copy buffer overflow later. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 corresponding to OpenCV-Python 3.3.0.9 and...

8.8CVSS7.1AI score0.03066EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Out-of-bounds Write in OpenCV

OpenCV Open Source Computer Vision Library through 3.3 corresponding to opencv-python and opencv-contrib-python through 3.3.0.9 has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread...

8.8CVSS6.8AI score0.0197EPSS
SaveExploits0References12Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Out-of-bounds Read in OpenCV

OpenCV Open Source Computer Vision Library through 3.3 corresponding to OpenCV-Python 3.3.0.9 has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the...

8.8CVSS6.7AI score0.0197EPSS
SaveExploits0References12Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Out-of-bounds Read in OpenCV

OpenCV Open Source Computer Vision Library through 3.3 corresponding to OpenCV-Python 3.3.0.9 has an out-of-bounds read error in the function icvCvtBGRA2BGR8uC4C3R when reading an image file by using cv::imread...

8.8CVSS6.6AI score0.0197EPSS
SaveExploits0References12Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Out-of-bounds Write in OpenCV

OpenCV Open Source Computer Vision Library through 3.3 corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9 has an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file by using cv::imread...

8.8CVSS6.8AI score0.0197EPSS
SaveExploits0References10Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS...

6.1CVSS6.4AI score0.00743EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Improper Input Validation in OpenCV

OpenCV 3.0.0 allows remote attackers to cause a denial of service segfault via vectors involving corrupt chunks. This issue was fixed in OpenCV version 3.3.1 corresponding to OpenCV 3.3.1.11...

5.5CVSS6.5AI score0.01582EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

SSRF attacks via tracebacks in Plone

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...

8.8CVSS7AI score0.01423EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Improper Restriction of XML External Entity Reference in Plone

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...

8.8CVSS7AI score0.01423EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.16 views

Improper Restriction of XML External Entity Reference in Plone

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...

8.8CVSS7AI score0.01423EPSS
SaveExploits0References7Affected Software1
Total number of security vulnerabilities5000