https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 21:51:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-357548 EUVD-2026-357548 https://cve.radiocsirt.org/vuln/euvd-2026-357548 https://cve.radiocsirt.org/vuln/fkie_cve-2026-15679 <p>Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27987.</p> <p>Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27987.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-15679 https://cve.radiocsirt.org/vuln/ghsa-5whh-98v9-qrw2 <p>Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27987.</p> <p>Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.</p> <p>The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27987.</p> https://cve.radiocsirt.org/vuln/ghsa-5whh-98v9-qrw2 https://cve.radiocsirt.org/vuln/rhsa-2026:83112 <p>timm: Hugging Face PyTorch Image Models: Remote Code Execution via Deserialization of Untrusted Data vllm: vLLM: Denial of Service via memory exhaustion from oversized media files vllm: vLLM: Denial of Service via crafted prompt in /v1/completions request vllm: vLLM: Denial of Service via negative token ID input urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser vllm: vLLM: Denial of Service via unbounded media ingestion pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets werkzeug: werkzeug: Denial of Service via safe_join() Windows special device paths fsspec: fsspec: Arbitrary code execution via crafted reference documents multidict: multidict: Denial of Service via memory leak in items-view operations</p> <p>timm: Hugging Face PyTorch Image Models: Remote Code Execution via Deserialization of Untrusted Data vllm: vLLM: Denial of Service via memory exhaustion from oversized media files vllm: vLLM: Denial of Service via crafted prompt in /v1/completions request vllm: vLLM: Denial of Service via negative token ID input urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser vllm: vLLM: Denial of Service via unbounded media ingestion pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets werkzeug: werkzeug: Denial of Service via safe_join() Windows special device paths fsspec: fsspec: Arbitrary code execution via crafted reference documents multidict: multidict: Denial of Service via memory leak in items-view operations</p> https://cve.radiocsirt.org/vuln/rhsa-2026:83112