Medium
CVE-2023-48299
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 152
Reset filters
Critical
CVE-2026-14535
In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless o
High
CVE-2026-57516
Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)
Critical
CVE-2023-43654
TorchServe Server-Side Request Forgery vulnerability
Critical
CVE-2024-35198
TorchServe vulnerable to bypass of allowed_urls configuration
Critical
CVE-2025-68664
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
Critical
CVE-2025-47277
vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
Critical
CVE-2025-27520
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
High
CVE-2026-41523
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution
Medium
CVE-2025-71378
Picklescan is missing detection when calling built-in Python cProfile.runctx
High
CVE-2025-71357
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
High
CVE-2025-71348
Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config
High
CVE-2026-56340
vLLM introduced enhanced protection for CVE-2025-62164
Critical
CVE-2026-31239
mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub
Critical
CVE-2026-31238
Ludwig framework is vulnerable to insecure deserialization in its model serving component
High
CVE-2026-31221
PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization
Critical
CVE-2026-44484
Compromise of PyTorch Lightning PyPi Package Versions
Medium
CVE-2026-1839
HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class
Medium
CVE-2026-34760
vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models
High
CVE-2024-49048
TorchGeo Remote Code Execution Vulnerability
High
CVE-2026-4538
A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be pe
High
CVE-2026-25048
xgrammar vulnerable to DoS via multi-layer nesting
Low
ghsa-83pf-v6qq-pwmr
Fickling has a detection bypass via stdlib network-protocol constructors
High
CVE-2026-24747
PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.