High
CVE-2026-31224
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 152
Reset filters
High
CVE-2026-31222
Snorkel Trainer.load uses an unsafe torch.load
High
CVE-2026-31253
flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism
High
CVE-2026-53875
Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER
High
CVE-2025-71322
Picklescan Bypasses Unsafe Globals Check using pty.spawn
Medium
CVE-2025-71339
Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length
High
CVE-2025-67729
lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()
Medium
CVE-2025-68146
filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
High
CVE-2025-62164
vLLM deserialization vulnerability leading to DoS and potential RCE
High
CVE-2025-71344
Picklescan is missing detection when calling built-in python ensurepip._run_pip
High
CVE-2025-71361
Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip
High
CVE-2025-71358
Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity
High
CVE-2025-71354
Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem
Medium
CVE-2025-5197
Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability
Medium
CVE-2025-54952
ExecuTorch integer overflow vulnerability leads to code execution
High
CVE-2025-53002
LLaMA-Factory allows Code Injection through improper vhead_file safeguards
Medium
CVE-2025-5150
docarray prototype pollution
Medium
CVE-2025-3730
PyTorch Improper Resource Shutdown or Release vulnerability
High
CVE-2025-30202
Data exposure via ZeroMQ on multi-node vLLM deployment
Medium
CVE-2025-46567
LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py
Medium
CVE-2024-6577
TorchServe script references S3 bucket without ensuring ownership or confirming accessibility
High
CVE-2024-35199
TorchServe gRPC Port Exposure
Medium
CVE-2024-41129
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
CVE-2024-37059
MLFlow unsafe deserialization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.