Lucene search
+L
PypaMost viewed

7218 matches found

PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to segfault in `QuantizedRelu` and `QuantizedRelu6`

ImpactIf QuantizedRelu or QuantizedRelu6 are given nonscalar inputs for minfeatures or maxfeatures, it results in a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfouttype = tf.quint8features = tf.constant28, shape=4,2, dtype=tf.quint8minfeatures =...

7.5CVSS6.9AI score0.00439EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to `CHECK` fail in `Conv2DBackpropInput`

ImpactThe implementation of Conv2DBackpropInput requires inputsizes to be 4-dimensional. Otherwise, it gives a CHECK failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tfstrides = 1, 1, 1, 1padding = "SAME"usecudnnongpu = Trueexplicitpaddings = dataformat =...

7.5CVSS6.9AI score0.00398EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to segfault in `QuantizedBiasAdd`

ImpactIf QuantizedBiasAdd is given mininput, maxinput, minbias, maxbias tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfouttype = tf.qint32input = tf.constant85,170,255, shape=3, dtype=tf.quint8bias =...

7.5CVSS6.9AI score0.00424EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to segfault in `QuantizedBiasAdd`

ImpactIf QuantizedBiasAdd is given mininput, maxinput, minbias, maxbias tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfouttype = tf.qint32input = tf.constant85,170,255, shape=3, dtype=tf.quint8bias =...

7.5CVSS6.9AI score0.00424EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to segfault in `QuantizedAdd`

ImpactIf QuantizedAdd is given mininput or maxinput tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfToutput = tf.qint32x = tf.constant140, shape=1, dtype=tf.quint8y = tf.constant26, shape=10, dtype=tf.quint8mi...

7.5CVSS6.9AI score0.00424EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to segfault in `BlockLSTMGradV2`

ImpactThe implementation of BlockLSTMGradV2 does not fully validate its inputs. - wci, wcf, wco, b must be rank 1 - w, csprev, hprev must be rank 2 - x must be rank 3This results in a a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfusepeephole =...

7.5CVSS6.9AI score0.00424EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to segfault in `LowerBound` and `UpperBound`

ImpactIf LowerBound or UpperBound is given an emptysortedinputs input, it results in a nullptr dereference, leading to a segfault that can be used to trigger a denial of service attack.pythonimport tensorflow as tfouttype = tf.int32sortedinputs = tf.constant, shape=10,0, dtype=tf.float32values =...

7.5CVSS6.9AI score0.00398EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to `CHECK` failures in `FractionalAvgPoolGrad`

ImpactThe implementation of FractionalAvgPoolGrad does not fully validate the input originputtensorshape. This results in an overflow that results in a CHECK failure which can be used to trigger a denial of service attack.pythonimport tensorflow as tfoverlapping = Trueoriginputtensorshape =...

7.5CVSS7AI score0.00411EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to Int overflow in `RaggedRangeOp`

ImpactThe RaggedRangOp function takes an argument limits that is eventually used to construct a TensorShape as an int64. If limits is a very large float, it can overflow when converted to an int64. This triggers an InvalidArgument but also throws an abort signal that crashes the...

7.5CVSS7AI score0.00567EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to `CHECK` failures in `AvgPool3DGrad`

ImpactThe implementation of AvgPool3DGradOp does not fully validate the input originputshape. This results in an overflow that results in a CHECK failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tfksize = 1, 1, 1, 1, 1strides = 1, 1, 1, 1, 1padding =...

7.5CVSS7AI score0.00398EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to `CHECK` failures in `AvgPool3DGrad`

ImpactThe implementation of AvgPool3DGradOp does not fully validate the input originputshape. This results in an overflow that results in a CHECK failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tfksize = 1, 1, 1, 1, 1strides = 1, 1, 1, 1, 1padding =...

7.5CVSS7AI score0.00398EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to floating point exception in `Conv2D`

ImpactIf Conv2D is given empty input and the filter and padding sizes are valid, the output is all-zeros. This causes division-by-zero floating point exceptions that can be used to trigger a denial of service attack.pythonimport tensorflow as tfimport numpy as npwith tf.device"CPU": also can be...

7.5CVSS6.9AI score0.00411EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to null dereference on MLIR on empty function attributes

ImpactWhen mlir::tfg::ConvertGenericFunctionToFunctionDef is given empty function attributes, it gives a null dereference.cpp// Import the function attributes with a tf. prefix to match the current// infrastructure expectations.for const auto& namedAttr : func.attr const std::string& name = "tf."...

7.5CVSS7AI score0.00411EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to `CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs`

ImpactWhen tensorflow::fulltype::SubstituteFromAttrs receives a FullTypeDef& t that is not exactly three args, it triggers a CHECK-fail instead of returning a status.cppStatus SubstituteForEachAttrMap& attrs, FullTypeDef& t DCHECKEQt.argssize, 3; const auto& cont = t.args0; const auto& tmpl =...

7.5CVSS7AI score0.00567EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVarsGradient`

ImpactWhen tf.quantization.fakequantwithminmaxvarsgradient receives input min or max that is nonscalar, it gives a CHECK fail that can trigger a denial of service attack.pythonimport tensorflow as tfimport numpy as np arg0=tf.constantvalue=np.random.randomsize=2, 2, shape=2, 2,...

7.5CVSS6.9AI score0.00411EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to null-dereference in `mlir::tfg::TFOp::nameAttr`

ImpactWhen mlir::tfg::TFOp::nameAttr receives null type list attributes, it crashes.cppStatusOr GraphDefImporter::ArgNumTypeconst NamedAttrList , const OpDef::ArgDef def, SmallVectorImpl // Check whether a type list attribute is specified. if !argdef.typelistattr.empty if auto v =...

7.5CVSS7AI score0.0058EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to `CHECK` fail in `DenseBincount`

ImpactDenseBincount assumes its input tensor weights to either have the same shape as its input tensor input or to be length-0. A different weights shape will trigger a CHECK fail that can be used to trigger a denial of service attack.pythonimport tensorflow as tfbinaryoutput = Trueinput =...

7.5CVSS6.9AI score0.00411EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to integer overflow in math ops

ImpactWhen RangeSize receives values that do not fit into an int64t, it crashes.cpp auto size = std::isintegral::value ? Eigen::numext::abslimit - start + Eigen::numext::absdelta - T1 / Eigen::numext::absdelta : Eigen::numext::ceil Eigen::numext::abslimit - start / delta; // This check does not...

7.5CVSS7AI score0.00567EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow vulnerable to `CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs`

ImpactWhen tensorflow::fulltype::SubstituteFromAttrs receives a FullTypeDef& t that is not exactly three args, it triggers a CHECK-fail instead of returning a status.cppStatus SubstituteForEachAttrMap& attrs, FullTypeDef& t DCHECKEQt.argssize, 3; const auto& cont = t.args0; const auto& tmpl =...

7.5CVSS7AI score0.00567EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow segfault TFLite converter on per-channel quantized transposed convolutions

ImpactWhen converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process.pythonimport tensorflow as tfclass QuantConv2DTransposedtf.keras.layers.Layer: def buildself, inputshape: self.kernel = self.addweight"kernel", 3, 3,...

7.5CVSS6.9AI score0.00619EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.13 views

TensorFlow segfault TFLite converter on per-channel quantized transposed convolutions

ImpactWhen converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process.pythonimport tensorflow as tfclass QuantConv2DTransposedtf.keras.layers.Layer: def buildself, inputshape: self.kernel = self.addweight"kernel", 3, 3,...

7.5CVSS6.9AI score0.00619EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

TensorFlow vulnerable to `CHECK` fail in `tf.sparse.cross`

ImpactIf tf.sparse.cross receives an input separator that is not a scalar, it gives a CHECK fail that can be used to trigger a denial of service attack.pythonimport tensorflow as tftf.sparse.crossinputs=,name='a',separator=tf.constant'a', 'b',dtype=tf.string PatchesWe have patched the issue in...

7.5CVSS6.9AI score0.0042EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

TensorFlow vulnerable to `CHECK` failure in tf.reshape via overflows

ImpactThe implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure caused by overflowing the number of elements in a tensor:pythonimport tensorflow as tftf.reshapetensor=1,shape=tf.constant0 for i in range255, dtype=tf.int64This is...

7.5CVSS6.9AI score0.00411EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

TensorFlow vulnerable to OOB read in `Gather_nd` in TF Lite

ImpactThe GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. PatchesWe have patched the issue in GitHub commit...

9.1CVSS7AI score0.00458EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

TensorFlow vulnerable to `CHECK` failure in tf.reshape via overflows

ImpactThe implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure caused by overflowing the number of elements in a tensor:pythonimport tensorflow as tftf.reshapetensor=1,shape=tf.constant0 for i in range255, dtype=tf.int64This is...

7.5CVSS6.9AI score0.00411EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library

SummaryThe Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. SeverityModerat...

4.7CVSS6.4AI score0.00521EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Uncontrolled Resource Consumption in asyncua and opcua

All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited numb...

7.5CVSS7AI score0.01107EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Segfault if `tf.histogram_fixed_width` is called with NaN values in TensorFlow

ImpactThe implementation of tf.histogramfixedwidth is vulnerable to a crash when the values array contain NaN elements:pythonimport tensorflow as tfimport numpy as nptf.histogramfixedwidthvalues=np.nan, valuerange=1,2The implementation assumes that all floating point operations are defined and th...

5.5CVSS6.2AI score0.00314EPSS
SaveExploits1References13Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Missing validation causes denial of service via `Conv3DBackpropFilterV2`

ImpactThe implementation of tf.rawops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tftf.strings.unsortedsegmentjoin inputs='123', segmentids=0, numsegments=-1The...

5.5CVSS6.2AI score0.00346EPSS
SaveExploits1References13Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Missing validation results in undefined behavior in `SparseTensorDenseAdd

ImpactThe implementation of tf.rawops.SparseTensorDenseAdd does not fully validate the input arguments:pythonimport tensorflow as tfaindices = tf.constant0, shape=17, 2, dtype=tf.int64avalues = tf.constant, shape=0, dtype=tf.float32ashape = tf.constant6, 12, shape=2, dtype=tf.int64b =...

5.5CVSS6.2AI score0.00338EPSS
SaveExploits1References11Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Missing validation causes denial of service via `SparseTensorToCSRSparseMatrix`

ImpactThe implementation of tf.rawops.SparseTensorToCSRSparseMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tfindices = tf.constant53, shape=3, dtype=tf.int64values =...

5.5CVSS6.2AI score0.00317EPSS
SaveExploits1References11Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Missing validation crashes `QuantizeAndDequantizeV4Grad`

ImpactThe implementation of tf.rawops.QuantizeAndDequantizeV4Grad does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tftf.rawops.QuantizeAndDequantizeV4Grad gradients=tf.constant1,...

5.5CVSS6.2AI score0.0034EPSS
SaveExploits1References11Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Missing validation causes `TensorSummaryV2` to crash

ImpactThe implementation of tf.rawops.TensorSummaryV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport numpy as npimport tensorflow as tftf.rawops.TensorSummaryV2 tag=np.array'test', tensor=np.array3,...

5.5CVSS6.2AI score0.00317EPSS
SaveExploits1References11Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

XML Entity Expansion in trytond and proteus

An XML Entity Expansion XEE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. A...

7.5CVSS7AI score0.01957EPSS
SaveExploits0References10Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

OpenStack Keystone and other components vulnerable to Improper Certificate Validation

HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates...

5.9CVSS6.4AI score0.00962EPSS
SaveExploits1References14Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Use after free in `DecodePng` kernel

ImpactA malicious user can cause a use after free behavior when decoding PNG images:ccif / ... error conditions ... / png::CommonFreeDecode; OPREQUIREScontext, false, errors::InvalidArgument"PNG size too large for int: ", decode.width, " by ", decode.height; After png::CommonFreeDecode gets calle...

7.6CVSS6.7AI score0.00725EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Memory exhaustion in Tensorflow

Impact The implementation of StringNGrams can be used to trigger a denial of service attack by causing an OOM condition after an integer overflow:pythonimport tensorflow as tftf.rawops.StringNGrams data='123456', datasplits=0,1, separator='a'15, ngramwidths=, leftpad='', rightpad='', padwidth=-5,...

6.5CVSS6.6AI score0.00821EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Integer overflow in Tensorflow

ImpactThe implementation of Range suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations. PatchesWe have patched the issue in GitHub commit f0147751fd5d2ff23251149ebad9af9f03010732 merging 51733.The fix will be included in TensorFlo...

8.8CVSS7AI score0.00578EPSS
SaveExploits0References10Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

`CHECK`-failures in Tensorflow

ImpactAn attacker can trigger denial of service via assertion failure by altering a SavedModel on disk such that AttrDefs of some operation are duplicated. PatchesWe have patched the issue in GitHub commit c2b31ff2d3151acb230edc3f5b1832d2c713a9e0.The fix will be included in TensorFlow 2.8.0. We...

7.1CVSS6.7AI score0.00469EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Division by zero in TFLite

Impact An attacker can craft a TFLite model that would trigger a division by zero in the implementation of depthwise convolutions.The parameters of the convolution can be user controlled and are also used within a division operation to determine the size of the padding that needs to be added befo...

7.1CVSS6.6AI score0.00821EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Integer overflow in TFLite array creation

Impact An attacker can craft a TFLite model that would cause an integer overflow in TfLiteIntArrayCreate:ccTfLiteIntArray TfLiteIntArrayCreateint size int allocsize = TfLiteIntArrayGetSizeInBytessize; // ... TfLiteIntArray ret = TfLiteIntArraymallocallocsize; // ... The TfLiteIntArrayGetSizeInByt...

8.8CVSS7AI score0.00811EPSS
SaveExploits1References10Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Null-dereference in Tensorflow

ImpactWhen decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK:cc const auto attr = attrs.Findarg-s; DCHECKattr != nullptr; if attr-valuecase == AttrValue::kList ...

7.1CVSS6.7AI score0.00992EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Undefined behavior in `SparseTensorSliceDataset`

Impact The implementation of SparseTensorSliceDataset has an undefined behavior: under certain condition it can be made to dereference a nullptr value:pythonimport tensorflow as tfimport numpy as nptf.rawops.SparseTensorSliceDataset indices=, values=, denseshape=1,1The 3 input arguments represent...

7.6CVSS6.6AI score0.00746EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Null pointer dereference in Grappler's `IsConstant`

ImpactUnder certain scenarios, Grappler component of TensorFlow can trigger a null pointer dereference. There are 2 places where this can occur, for the same malicious alteration of a SavedModel file fixing the first one would trigger the same dereference in the second place:First, during constan...

6.5CVSS6.7AI score0.01097EPSS
SaveExploits1References11Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Segfault in `simplifyBroadcast` in Tensorflow

ImpactThe simplifyBroadcast function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault hence, denial of service, if called with scalar shapes.cc sizet maxRank = 0; for auto shape : llvm::enumerateshapes auto foundshape = analysis.dimensionsForShapeTensorshape.value; if...

8.2CVSS7AI score0.0087EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Out of bounds read in Tensorflow

ImpactTensorFlow's type inference can cause a heap OOB read as the bounds checking is done in a DCHECK which is a no-op during production:ccif nodet.typeid != TFTUNSET int ix = inputidxi; DCHECKix nodet.argssize "input " i " should have an output " ix " but instead only has " nodet.argssize "...

8.1CVSS7AI score0.00858EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Crash when type cannot be specialized in Tensorflow

ImpactUnder certain scenarios, TensorFlow can fail to specialize a type during shape inference:ccvoid InferenceContext::PreInputInit const OpDef& opdef, const std::vector& inputtensors, const std::vector& inputtensorsasshapes const auto ret = fulltype::SpecializeTypeattrs, opdef;...

7.1CVSS6.7AI score0.00992EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Reachable Assertion in Tensorflow

ImpactWhen decoding a tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments, if the tensors have an invalid dtype and 0 elements or an invalid shape. This allows attackers to cause denial of services in TensorFlow...

7.1CVSS6.7AI score0.00469EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Out of bounds read in Tensorflow

Impact The implementation of FractionalAvgPoolGrad does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap:pythonimport tensorflow as [email protected] test: y = tf.rawops.FractionalAvgPoolGrad originputtensorshape=2,2,2,2,...

8.1CVSS6.9AI score0.00815EPSS
SaveExploits1References9Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.13 views

Multiple `CHECK`-fails in `function.cc` in TensowFlow

ImpactA malicious user can cause a denial of service by altering a SavedModel such that assertions in function.cc would be falsified and crash the Python interpreter. PatchesWe have patched the issue in GitHub commits dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2 and...

6.5CVSS6.7AI score0.008EPSS
SaveExploits1References10Affected Software1
Total number of security vulnerabilities5000