https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:55:40 +0000 https://cve.radiocsirt.org/vuln/brew-mlx-lm-cve-2025-14929 <p><strong>Affected:</strong> Homebrew: mlx-lm</p> <p>Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28308.</p> <p><strong>Affected:</strong> Homebrew: mlx-lm</p> <p>Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28308.</p> https://cve.radiocsirt.org/vuln/brew-mlx-lm-cve-2025-14929 https://cve.radiocsirt.org/vuln/euvd-2026-264349 EUVD-2026-264349 https://cve.radiocsirt.org/vuln/euvd-2026-264349 https://cve.radiocsirt.org/vuln/fkie_cve-2025-14929 <p>Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28308.</p> <p>Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28308.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-14929 https://cve.radiocsirt.org/vuln/ghsa-8jfx-5878-hv4v <p>Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28308.</p> <p>Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28308.</p> https://cve.radiocsirt.org/vuln/ghsa-8jfx-5878-hv4v https://cve.radiocsirt.org/vuln/pysec-2025-217 <p><strong>Affected:</strong> PyPI: transformers</p> <p>Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28308.</p> <p><strong>Affected:</strong> PyPI: transformers</p> <p>Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28308.</p> https://cve.radiocsirt.org/vuln/pysec-2025-217 https://cve.radiocsirt.org/vuln/rhsa-2026:3713 <p>github.com/containerd/containerd: containerd local privilege escalation vllm: Server Side request forgery (SSRF) in MediaConnector keras: Path Traversal Vulnerability in keras node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement transformers: code execution when processing a malicious Perceiver model file transformers: code execution when processing a malicious Transformer-XL model file diffusers: Hugging Face Diffusers: Remote Code Execution via Deserialization of Untrusted Data transformers: code execution when processing a malicious megatron_gpt2 model file accelerate: Hugging Face Accelerate: Remote Code Execution via Deserialization of Untrusted Data transformers: code execution when converting a malicious SEW model checkpoint transformers: code execution when converting a malicious SEW-D model checkpoint transformers: code execution when converting a malicious HuBERT model checkpoint transformers: code execution when processing a malicious X-CLIP model file transformers: code execution when processing a malicious GLM4 model file qs: qs: Denial of Service via improper input validation in array parsing vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects v…</p> <p>github.com/containerd/containerd: containerd local privilege escalation vllm: Server Side request forgery (SSRF) in MediaConnector keras: Path Traversal Vulnerability in keras node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement transformers: code execution when processing a malicious Perceiver model file transformers: code execution when processing a malicious Transformer-XL model file diffusers: Hugging Face Diffusers: Remote Code Execution via Deserialization of Untrusted Data transformers: code execution when processing a malicious megatron_gpt2 model file accelerate: Hugging Face Accelerate: Remote Code Execution via Deserialization of Untrusted Data transformers: code execution when converting a malicious SEW model checkpoint transformers: code execution when converting a malicious SEW-D model checkpoint transformers: code execution when converting a malicious HuBERT model checkpoint transformers: code execution when processing a malicious X-CLIP model file transformers: code execution when processing a malicious GLM4 model file qs: qs: Denial of Service via improper input validation in array parsing vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects v…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:3713