https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T05:51:45.297225+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-tensorflow-2021-37660 BIT-tensorflow-2021-37660 — Division by 0 in inplace operations in TensorFlow 2026-10-06T05:51:45.312131+00:00

Affected: Bitnami: tensorflow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/inplace_ops.cc#L283) has a logic error: it should skip processing if `x` and `v` are empty but the code uses `||` instead of `&&`. We have patched the issue in GitHub commit e86605c0a336c088b638da02135ea6f9f6753618. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

 https://cve.radiocsirt.org/vuln/cnvd-2021-64069 cnvd-2021-64069 2026-10-06T05:51:45.312193+00:00 cnvd-2021-64069 https://cve.radiocsirt.org/vuln/euvd-2026-29900 EUVD-2026-29900 2026-10-06T05:51:45.312212+00:00 EUVD-2026-29900 https://cve.radiocsirt.org/vuln/fkie_cve-2021-37660 fkie_cve-2021-37660 2026-10-06T05:51:45.312224+00:00

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/inplace_ops.cc#L283) has a logic error: it should skip processing if `x` and `v` are empty but the code uses `||` instead of `&&`. We have patched the issue in GitHub commit e86605c0a336c088b638da02135ea6f9f6753618. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

 https://cve.radiocsirt.org/vuln/ghsa-cm5x-837x-jf3c GHSA-cm5x-837x-jf3c — Division by 0 in inplace operations 2026-10-06T05:51:45.312250+00:00

Affected: PyPI: tensorflow, PyPI: tensorflow-cpu, PyPI: tensorflow-gpu

### Impact An attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0:

```python import tensorflow as tf

tf.raw_ops.InplaceSub(x=[],i=[-99,-1,-1],v=[1,1,1]) ```

The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/inplace_ops.cc#L283) has a logic error: it should skip processing if `x` and `v` are empty but the code uses `||` instead of `&&`.

### Patches We have patched the issue in GitHub commit [e86605c0a336c088b638da02135ea6f9f6753618](https://github.com/tensorflow/tensorflow/commit/e86605c0a336c088b638da02135ea6f9f6753618).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

 https://cve.radiocsirt.org/vuln/gsd-2021-37660 gsd-2021-37660 2026-10-06T05:51:45.312289+00:00 gsd-2021-37660 https://cve.radiocsirt.org/vuln/opensuse-su-2022:10014-1 openSUSE-SU-2022:10014-1 — Security update for tensorflow2 2026-10-06T05:51:45.312301+00:00

Security update for tensorflow2

 https://cve.radiocsirt.org/vuln/pysec-2021-282 PYSEC-2021-282 2026-10-06T05:51:45.312341+00:00

Affected: PyPI: tensorflow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/inplace_ops.cc#L283) has a logic error: it should skip processing if `x` and `v` are empty but the code uses `||` instead of `&&`. We have patched the issue in GitHub commit e86605c0a336c088b638da02135ea6f9f6753618. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.