https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:14:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338600 EUVD-2026-338600 https://cve.radiocsirt.org/vuln/euvd-2026-338600 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58659 <p>PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.</p> <p>PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58659 https://cve.radiocsirt.org/vuln/ghsa-qqmf-gpg7-g8gw <p><strong>Affected:</strong> PyPI: lightning</p> <p>PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.</p> <p><strong>Affected:</strong> PyPI: lightning</p> <p>PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.</p> https://cve.radiocsirt.org/vuln/ghsa-qqmf-gpg7-g8gw https://cve.radiocsirt.org/vuln/pysec-2026-3624 <p><strong>Affected:</strong> PyPI: lightning</p> <p>PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.</p> <p><strong>Affected:</strong> PyPI: lightning</p> <p>PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.</p> https://cve.radiocsirt.org/vuln/pysec-2026-3624 https://cve.radiocsirt.org/vuln/rhsa-2026:68698 <p>sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id libaom: libaom: remote code execution via SVC layer context handling with attacker-controlled frames FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream pytorch-lightning: PyTorch Lightning: Remote code execution via malicious checkpoint files FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses</p> <p>sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id libaom: libaom: remote code execution via SVC layer context handling with attacker-controlled frames FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream pytorch-lightning: PyTorch Lightning: Remote code execution via malicious checkpoint files FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses</p> https://cve.radiocsirt.org/vuln/rhsa-2026:68698