https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T03:10:36.852058+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-09614 bdu:2024-09614 2026-10-07T03:10:36.856979+00:00 bdu:2024-09614 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0978 certfr-2024-avi-0978 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un at… 2026-10-07T03:10:36.857016+00:00 certfr-2024-avi-0978 https://cve.radiocsirt.org/vuln/euvd-2026-246940 EUVD-2026-246940 2026-10-07T03:10:36.857036+00:00 EUVD-2026-246940 https://cve.radiocsirt.org/vuln/fkie_cve-2024-49048 fkie_cve-2024-49048 2026-10-07T03:10:36.857049+00:00

TorchGeo Remote Code Execution Vulnerability

 https://cve.radiocsirt.org/vuln/ghsa-ghq9-vc6f-8qjf GHSA-ghq9-vc6f-8qjf — TorchGeo Remote Code Execution Vulnerability 2026-10-07T03:10:36.857077+00:00

Affected: PyPI: torchgeo

### Impact

TorchGeo 0.4–0.6.0 used an [`eval`](https://docs.python.org/3/library/functions.html#eval) statement in its model weight API that could allow an unauthenticated, remote attacker to execute arbitrary commands. All platforms that expose [`torchgeo.models.get_weight()`](https://torchgeo.readthedocs.io/en/v0.6.0/api/models.html#torchgeo.models.get_weight) or [`torchgeo.trainers`](https://torchgeo.readthedocs.io/en/v0.6.0/api/trainers.html) as an external API could be affected.

### Patches

The `eval` statement was replaced with a fixed enum lookup, preventing arbitrary code injection. All users are encouraged to upgrade to TorchGeo 0.6.1 or newer.

### Workarounds

In unpatched versions, input validation and sanitization can be used to avoid this vulnerability.

### References

#### Bug history

* Introduced: https://github.com/torchgeo/torchgeo/pull/917 * Patched: https://github.com/torchgeo/torchgeo/pull/2323 * Released: [v0.6.1](https://github.com/microsoft/torchgeo/releases/tag/v0.6.1)

 https://cve.radiocsirt.org/vuln/msrc_cve-2024-49048 msrc_CVE-2024-49048 — TorchGeo Remote Code Execution Vulnerability 2026-10-07T03:10:36.857115+00:00 msrc_CVE-2024-49048 https://cve.radiocsirt.org/vuln/pysec-2024-204 PYSEC-2024-204 2026-10-07T03:10:36.857132+00:00

Affected: PyPI: torchgeo

TorchGeo Remote Code Execution Vulnerability

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3449 WID-SEC-W-2024-3449 — Microsoft LightGBM und TorchGeo: Mehrere Schwachstellen ermöglichen Codeausführung 2026-10-07T03:10:36.857148+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft LightGBM und TorchGeo ausnutzen, um beliebigen Programmcode auszuführen.