https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:03:25.593226+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-69112 CVE-2026-69112 — Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map 2026-10-03T11:03:25.628576+00:00

Affected: huggingface accelerate

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service.

 https://cve.radiocsirt.org/vuln/ghsa-4j2p-28q2-5m79 GHSA-4j2p-28q2-5m79 — Accelerate path traversal and denial of service via sharded checkpoint weight_map entries 2026-10-03T11:03:25.628648+00:00

Affected: PyPI: accelerate

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service.