https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:52:19 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44484 <p><strong>Affected:</strong> Lightning-AI pytorch-lightning, Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI)</p> <p>PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.</p> <p><strong>Affected:</strong> Lightning-AI pytorch-lightning, Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI)</p> <p>PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.</p> https://cve.radiocsirt.org/vuln/cve-2026-44484 https://cve.radiocsirt.org/vuln/ghsa-w37p-236h-pfx3 <p><strong>Affected:</strong> PyPI: pytorch-lightning</p> <p># Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions</p> <p>**Published:** 2026-04-30 **Last Updated:** 2026-05-12</p> <p>**Github Advisory:** [CVE-2026-44484](https://github.com/advisories/GHSA-w37p-236h-pfx3)</p> <p>We have identified a security incident affecting certain versions of one of our PyPI packages.</p> <p>## What happened</p> <p>We have determined that one or more released versions of this package have been compromised and include malicious code.</p> <p>Our current investigation indicates that the affected versions have introduced functionality consistent with a credential harvesting mechanism. We are still actively analysing the scope and behaviour of the code.</p> <p>At this stage, the root cause of the compromise is still under investigation.</p> <p>## What versions are affected</p> <p>We are currently working to confirm the exact set of impacted versions.</p> <p>We have determined the following versions as affected and ask that you delete them from your systems:</p> <p>- `2.6.2` - `2.6.3`</p> <p>We will update this advisory if the versions impacted by this vulnerability change.</p> <p>## What you should do immediately</p> <p>If you have installed or are running any potentially affected versions:</p> <p>- Assume the environment may be compromised - Immediately rotate all credentials and secrets that may have been exposed, including: - API keys - Access tokens - SSH keys - Service account credentials - Rebuild affected systems from a known clean state - Pin PyTorch Lightning to version `2.6.1` - Revi…</p> <p><strong>Affected:</strong> PyPI: pytorch-lightning</p> <p># Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions</p> <p>**Published:** 2026-04-30 **Last Updated:** 2026-05-12</p> <p>**Github Advisory:** [CVE-2026-44484](https://github.com/advisories/GHSA-w37p-236h-pfx3)</p> <p>We have identified a security incident affecting certain versions of one of our PyPI packages.</p> <p>## What happened</p> <p>We have determined that one or more released versions of this package have been compromised and include malicious code.</p> <p>Our current investigation indicates that the affected versions have introduced functionality consistent with a credential harvesting mechanism. We are still actively analysing the scope and behaviour of the code.</p> <p>At this stage, the root cause of the compromise is still under investigation.</p> <p>## What versions are affected</p> <p>We are currently working to confirm the exact set of impacted versions.</p> <p>We have determined the following versions as affected and ask that you delete them from your systems:</p> <p>- `2.6.2` - `2.6.3`</p> <p>We will update this advisory if the versions impacted by this vulnerability change.</p> <p>## What you should do immediately</p> <p>If you have installed or are running any potentially affected versions:</p> <p>- Assume the environment may be compromised - Immediately rotate all credentials and secrets that may have been exposed, including: - API keys - Access tokens - SSH keys - Service account credentials - Rebuild affected systems from a known clean state - Pin PyTorch Lightning to version `2.6.1` - Revi…</p> https://cve.radiocsirt.org/vuln/ghsa-w37p-236h-pfx3