https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T20:33:52.413843+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-10939 EUVD-2026-10939 2026-10-06T20:33:52.417245+00:00 EUVD-2026-10939 https://cve.radiocsirt.org/vuln/fkie_cve-2022-0315 fkie_cve-2022-0315 2026-10-06T20:33:52.417277+00:00

Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.

 https://cve.radiocsirt.org/vuln/ghsa-47wv-vhj2-g66m GHSA-47wv-vhj2-g66m — Use of insecure temporary file in Horovod 2026-10-06T20:33:52.417312+00:00

Affected: PyPI: horovod

### Impact The insecure `tempfile.mktemp()` is used when Horovod is run in an LSF job with `jsrun`. In that situation, a jsrun rank file is created with `mktemp`, which could be hijacked by another process to read or manipulate the content.

This issue does not impact the use of MPI, Gloo, Spark or Ray.

### Patches The problem has been fixed in [b96ecae4](https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41).

### Workarounds The rank file is not created when `binding_args` are provided in the `Settings` instance.

### References Please see https://github.com/horovod/horovod/pull/3358 for details.

### For more information If you have any questions or comments about this advisory: * Open an issue in [https://github.com/horovod/horovod](https://github.com/horovod/horovod/issues/new/choose)

 https://cve.radiocsirt.org/vuln/gsd-2022-0315 gsd-2022-0315 2026-10-06T20:33:52.417346+00:00 gsd-2022-0315 https://cve.radiocsirt.org/vuln/pysec-2022-175 PYSEC-2022-175 2026-10-06T20:33:52.417359+00:00

Affected: PyPI: horovod

Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.