https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T08:13:26.761758+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-04916 bdu:2025-04916 2026-10-03T08:13:26.839533+00:00 bdu:2025-04916 https://cve.radiocsirt.org/vuln/bit-pytorch-2025-32434 BIT-pytorch-2025-32434 — PyTorch: `torch.load` with `weights_only=True` leads to remote code execution 2026-10-03T08:13:26.839570+00:00

Affected: Bitnami: pytorch

PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0508 certfr-2025-avi-0508 — De multiples vulnérabilités ont été découvertes dans les produits Splunk. Elles permettent à un attaquant de provoquer… 2026-10-03T08:13:26.839603+00:00 certfr-2025-avi-0508 https://cve.radiocsirt.org/vuln/cnvd-2025-23352 cnvd-2025-23352 2026-10-03T08:13:26.839621+00:00 cnvd-2025-23352 https://cve.radiocsirt.org/vuln/euvd-2026-262059 EUVD-2026-262059 2026-10-03T08:13:26.839632+00:00 EUVD-2026-262059 https://cve.radiocsirt.org/vuln/fkie_cve-2025-32434 fkie_cve-2025-32434 2026-10-03T08:13:26.839643+00:00

PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.

 https://cve.radiocsirt.org/vuln/ghsa-53q9-r3pm-6pq6 GHSA-53q9-r3pm-6pq6 — PyTorch: `torch.load` with `weights_only=True` leads to remote code execution 2026-10-03T08:13:26.839663+00:00

Affected: PyPI: torch

# Description I found a Remote Command Execution (RCE) vulnerability in PyTorch. When loading model using torch.load with weights_only=True, it can still achieve RCE.

# Background knowledge https://github.com/pytorch/pytorch/security As you can see, the PyTorch official documentation considers using `torch.load()` with `weights_only=True` to be safe. ![image](https://github.com/user-attachments/assets/fdaa8520-d66a-473a-ab1f-163d793de298) Since everyone knows that weights_only=False is unsafe, so they will use the weights_only=True to mitigate the seucirty issue. But now, I just proved that even if you use weights_only=True, it can still achieve RCE.

# Credit This vulnerability was found by Ji'an Zhou.

 https://cve.radiocsirt.org/vuln/msrc_cve-2025-32434 msrc_CVE-2025-32434 — PyTorch: `torch.load` with `weights_only=True` leads to remote code execution 2026-10-03T08:13:26.839689+00:00 msrc_CVE-2025-32434 https://cve.radiocsirt.org/vuln/pysec-2025-41 PYSEC-2025-41 2026-10-03T08:13:26.839705+00:00

Affected: PyPI: torch

PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0857 WID-SEC-W-2025-0857 — PyTorch: Schwachstelle ermöglicht Codeausführung 2026-10-03T08:13:26.839723+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in PyTorch ausnutzen, um beliebigen Programmcode auszuführen.