{"schemaVersion":"ki-abhaengigkeitsatlas/v1","dataset":"german-public-sector-ai-dependency-atlas","parserVersion":"1","generatedAt":"2026-07-20T11:49:05.682Z","trackingSince":"2026-07-18T21:20:30.334Z","source":{"codeRadar":{"dataset":"german-public-sector-ai-code-radar","generatedAt":"2026-07-20T11:47:56.369Z","parserVersion":"3","url":"https://i6eal.de/tools/ki-code-radar/"},"openCode":{"label":"openCode GitLab","url":"https://gitlab.opencode.de/"},"depsDev":{"label":"deps.dev API v3","url":"https://docs.deps.dev/api/v3/"},"osv":{"label":"OSV API","url":"https://google.github.io/osv.dev/api/"},"spdx":{"label":"SPDX License List","url":"https://spdx.org/licenses/","version":"3.28.0","releaseDate":"2026-02-20T00:00:00Z"}},"coverage":{"repositoryCount":30,"completeTreeCount":29,"incompleteTreeCount":1,"lockfileRepositoryCount":17,"sbomRepositoryCount":4,"artifactRepositoryCount":20,"resolvedRepositoryCount":29,"resolvedArtifactRepositoryCount":20,"dependencyFileCount":33,"parsedFileCount":32,"parseErrorCount":1,"unsupportedFileCount":0,"evaluatedVersionCount":4205,"metadataResolvedCount":4191,"metadataNotFoundCount":14,"osvEvaluatedVersionCount":4205,"codeRadarRepositoryCount":30},"methodology":{"componentParserSchemaVersion":"ki-dependency-atlas-components/v1","candidateBoundary":"repositories_with_exact_ai_code_evidence","resolvedVersionBoundary":"exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin","manifestRangesResolved":false,"latestVersionSubstitution":false,"containerTagsVulnerabilityChecked":false,"osvClaim":"osv_matched_observed_resolved_package_version_at_collection_time","depsDevLicenseSemantics":"spdx_expressions_as_reported_without_inferred_compatibility","providerSemantics":"package_interface_presence_not_api_configuration_procurement_or_use","generativeAiUsed":false,"scoreUsed":false,"treeEntryCeiling":2500,"fileByteCeiling":5242880,"uniqueVersionCeiling":5000,"observedFormats":["package-lock.json / npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins"]},"summary":{"repositoryCount":30,"packageCount":2831,"aiPackageCount":41,"resolvedComponentCount":7181,"resolvedVersionCount":4205,"providerExposureRepositoryCount":7,"licenseExpressionCount":57,"knownLicensePackageCount":2796,"unknownLicensePackageCount":35,"advisoryCount":572,"matchedAdvisoryRepositoryCount":25,"topPackage":{"id":"package:pypi:openai","slug":"openai-0dd26ac5","label":"OpenAI SDK","repositoryCount":18,"repositoryShare":0.6}},"kind":"repository","entity":{"id":"opencode:8712","slug":"opencode-8712","gitlabProjectId":8712,"name":"F13-RAG","pathWithNamespace":"landeshauptstadt-muenchen/f-13-rag","description":"Microservice zur Durchsuchung von Texten und Datenbanken mit natürlicher Sprache","webUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/f-13-rag","commitSha":"ddae51bb41a08acf9c1bcdee5dc8ce92df04649c","commitUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/f-13-rag/-/commit/ddae51bb41a08acf9c1bcdee5dc8ce92df04649c","lastActivityAt":"2026-02-12T08:49:11.302Z","headCommittedAt":"2025-12-17T16:34:35.000Z","tree":{"complete":true,"entryCount":153,"truncated":false},"files":[],"resolvedComponentCount":29,"artifactResolvedComponentCount":0,"exactManifestPinCount":29,"packageCount":7,"ecosystems":["pypi"],"aiPackageCount":7,"licenseExpressionCount":3,"unknownLicensePackageCount":0,"advisoryIds":["GHSA-29pf-2h5f-8g72","GHSA-3749-ghw9-m3mg","GHSA-37mw-44qp-f5jm","GHSA-4w7r-h757-3r74","GHSA-53q9-r3pm-6pq6","GHSA-59p9-h35m-wg4g","GHSA-69w3-r845-3855","GHSA-6rvg-6v2m-4j46","GHSA-887c-mr87-cxwp","GHSA-9356-575x-2w9m","GHSA-c678-jfcj-6jmf","GHSA-f4hp-rmr7-r7v8","GHSA-fgcw-684q-jj6r","GHSA-fpwr-67px-3qhx","GHSA-hxxf-235m-72v3","GHSA-jjph-296x-mrcr","GHSA-phhr-52qp-3mj4","GHSA-q2wp-rjmx-x6x9","GHSA-qfhq-4f3w-5fph","GHSA-qq3j-4f4f-9583","GHSA-qxrp-vhvm-j765","GHSA-rcv9-qm8p-9p6j","GHSA-rrmf-rvhw-rf47","GHSA-vgrw-7cvw-pwgx","GHSA-wrfc-pvp9-mr9g","GHSA-x3gm-94wq-g975","PYSEC-2025-198","PYSEC-2025-199","PYSEC-2025-200","PYSEC-2025-201","PYSEC-2025-202","PYSEC-2025-203","PYSEC-2025-204","PYSEC-2025-205","PYSEC-2025-206","PYSEC-2025-207","PYSEC-2025-208","PYSEC-2025-209","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218","PYSEC-2026-139","PYSEC-2026-2286"],"advisoryCount":48,"providers":[]},"evidence":{"files":[{"path":"requirements-dev.txt","kind":"exact-manifest-pin","sourceUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/f-13-rag/-/blob/ddae51bb41a08acf9c1bcdee5dc8ce92df04649c/requirements-dev.txt","commitSha":"ddae51bb41a08acf9c1bcdee5dc8ce92df04649c","blobSha":"76efb9a752987481ba23ef081e7e3a05d59ed513","state":"parsed","componentCount":7},{"path":"requirements-gpu.in","kind":"exact-manifest-pin","sourceUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/f-13-rag/-/blob/ddae51bb41a08acf9c1bcdee5dc8ce92df04649c/requirements-gpu.in","commitSha":"ddae51bb41a08acf9c1bcdee5dc8ce92df04649c","blobSha":"6813fdb0df770767721e8b602ebe6c547b22da0b","state":"parsed","componentCount":1},{"path":"requirements-gpu.txt","kind":"exact-manifest-pin","sourceUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/f-13-rag/-/blob/ddae51bb41a08acf9c1bcdee5dc8ce92df04649c/requirements-gpu.txt","commitSha":"ddae51bb41a08acf9c1bcdee5dc8ce92df04649c","blobSha":"8c2dfe24b230ff6ad5cc0779e7e45ce51a1e20a1","state":"parsed","componentCount":7},{"path":"requirements-testing.txt","kind":"exact-manifest-pin","sourceUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/f-13-rag/-/blob/ddae51bb41a08acf9c1bcdee5dc8ce92df04649c/requirements-testing.txt","commitSha":"ddae51bb41a08acf9c1bcdee5dc8ce92df04649c","blobSha":"a62dcf771b99cedee4157c93a2e50d10f678e585","state":"parsed","componentCount":7},{"path":"requirements.txt","kind":"exact-manifest-pin","sourceUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/f-13-rag/-/blob/ddae51bb41a08acf9c1bcdee5dc8ce92df04649c/requirements.txt","commitSha":"ddae51bb41a08acf9c1bcdee5dc8ce92df04649c","blobSha":"da215299c628b804b28789cb8267236418948d82","state":"parsed","componentCount":7}],"occurrenceCount":29},"related":{"packages":[{"id":"package:pypi:transformers","slug":"transformers-65289303","identity":"pypi:transformers","label":"Transformers","aiRelevant":true,"provider":{"id":"hugging-face","label":"Hugging Face"},"advisoryCount":25,"licenseExpressions":["Apache-2.0"],"versions":["4.57.3"],"dossier":true,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["requirements-dev.txt","requirements-gpu.txt","requirements-testing.txt","requirements.txt"]},{"id":"package:pypi:torch","slug":"torch-47a5352a","identity":"pypi:torch","label":"PyTorch","aiRelevant":true,"provider":null,"advisoryCount":23,"licenseExpressions":["BSD-3-Clause"],"versions":["2.7.1","2.9.1+cpu"],"dossier":true,"occurrenceCount":5,"directOccurrenceCount":1,"evidenceFiles":["requirements-dev.txt","requirements-gpu.in","requirements-gpu.txt","requirements-testing.txt","requirements.txt"]},{"id":"package:pypi:openai","slug":"openai-0dd26ac5","identity":"pypi:openai","label":"OpenAI SDK","aiRelevant":true,"provider":{"id":"openai","label":"OpenAI"},"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2.12.0"],"dossier":true,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["requirements-dev.txt","requirements-gpu.txt","requirements-testing.txt","requirements.txt"]},{"id":"package:pypi:sentence-transformers","slug":"sentence-transformers-3f3d7a36","identity":"pypi:sentence-transformers","label":"Sentence Transformers","aiRelevant":true,"provider":{"id":"hugging-face","label":"Hugging Face"},"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["5.2.0"],"dossier":true,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["requirements-dev.txt","requirements-gpu.txt","requirements-testing.txt","requirements.txt"]},{"id":"package:pypi:accelerate","slug":"accelerate-7fac5dd9","identity":"pypi:accelerate","label":"Accelerate","aiRelevant":true,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.12.0"],"dossier":true,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["requirements-dev.txt","requirements-gpu.txt","requirements-testing.txt","requirements.txt"]},{"id":"package:pypi:tokenizers","slug":"tokenizers-7ba00902","identity":"pypi:tokenizers","label":"Hugging Face Tokenizers","aiRelevant":true,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.22.1"],"dossier":true,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["requirements-dev.txt","requirements-gpu.txt","requirements-testing.txt","requirements.txt"]},{"id":"package:pypi:scikit-learn","slug":"scikit-learn-ab0941d9","identity":"pypi:scikit-learn","label":"scikit-learn","aiRelevant":true,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["1.8.0"],"dossier":true,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["requirements-dev.txt","requirements-gpu.txt","requirements-testing.txt","requirements.txt"]}],"vulnerabilities":[{"id":"GHSA-29pf-2h5f-8g72","slug":"ghsa-29pf-2h5f-8g72-1d83ebb4","dossier":false,"summary":"HuggingFace transformers vulnerable to remote code execution","aliases":["CVE-2026-4372","PYSEC-2026-2289"],"sourceIds":["GHSA-29pf-2h5f-8g72","PYSEC-2026-2289"],"published":"2026-05-24T14:16:16.917Z","modified":"2026-07-13T16:45:06.535860363Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4372"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/a7f8e7ff37d87d1a1a0c8cf607971c607741452f"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/1f693a6e-6836-4b8b-a0bd-ca036fba8884"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-29pf-2h5f-8g72"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-3749-ghw9-m3mg","slug":"ghsa-3749-ghw9-m3mg-fadf4a32","dossier":false,"summary":"PyTorch susceptible to local Denial of Service","aliases":["BIT-pytorch-2025-2953","CVE-2025-2953","PYSEC-2025-191"],"sourceIds":["GHSA-3749-ghw9-m3mg","PYSEC-2025-191"],"published":"2025-03-30T16:15:14.380Z","modified":"2026-06-10T17:02:35.808223212Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2953"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/149274"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/149274#issue-2923122269"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-191.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/blob/main/SECURITY.md#untrusted-models"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.302006"},{"type":"ADVISORY","url":"https://vuldb.com/?id.302006"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.521279"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-3749-ghw9-m3mg"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-37mw-44qp-f5jm","slug":"ghsa-37mw-44qp-f5jm-fb05555e","dossier":false,"summary":"Transformers is vulnerable to ReDoS attack through its DonutProcessor class","aliases":["CVE-2025-3933","PYSEC-2026-1977"],"sourceIds":["GHSA-37mw-44qp-f5jm","PYSEC-2026-1977"],"published":"2025-07-11T12:30:32Z","modified":"2026-07-07T17:57:16.879129924Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3933"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/37788"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/ebbe9b12dd75b69f92100d684c47f923ee262a93"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/25282953-5827-4384-bb6f-5790d275721b"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-37mw-44qp-f5jm"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-4w7r-h757-3r74","slug":"ghsa-4w7r-h757-3r74-ca8973bc","dossier":false,"summary":"Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer","aliases":["CVE-2025-6921","PYSEC-2026-1980"],"sourceIds":["GHSA-4w7r-h757-3r74","PYSEC-2026-1980"],"published":"2025-09-23T15:31:09Z","modified":"2026-07-07T17:57:12.050585329Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6921"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/287d15a7-6e7c-45d2-8c05-11e305776f1f"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4w7r-h757-3r74"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-53q9-r3pm-6pq6","slug":"ghsa-53q9-r3pm-6pq6-6fbb0149","dossier":false,"summary":"PyTorch: `torch.load` with `weights_only=True` leads to remote code execution","aliases":["BIT-pytorch-2025-32434","CVE-2025-32434","PYSEC-2025-41"],"sourceIds":["GHSA-53q9-r3pm-6pq6","PYSEC-2025-41"],"published":"2025-04-18T15:19:28Z","modified":"2026-02-04T02:38:45.601605Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/pytorch/pytorch/security/advisories/GHSA-53q9-r3pm-6pq6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32434"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/8d4b8a920a2172523deb95bf20e8e52d50649c04"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-41.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"}],"versionKeys":["pypi:torch@2.5.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-59p9-h35m-wg4g","slug":"ghsa-59p9-h35m-wg4g-68657c65","dossier":false,"summary":"Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer","aliases":["CVE-2025-6638","PYSEC-2026-1981"],"sourceIds":["GHSA-59p9-h35m-wg4g","PYSEC-2026-1981"],"published":"2025-09-12T12:30:23Z","modified":"2026-07-07T17:56:49.269701149Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6638"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/6a6c933f-9ce8-4ded-8b3b-2c1444c61f36"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-59p9-h35m-wg4g"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-69w3-r845-3855","slug":"ghsa-69w3-r845-3855-1b4edc28","dossier":false,"summary":"HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class","aliases":["CVE-2026-1839","PYSEC-2026-2288"],"sourceIds":["GHSA-69w3-r845-3855","PYSEC-2026-2288"],"published":"2026-04-07T06:16:41.490Z","modified":"2026-07-13T16:45:06.516869221Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1839"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/huggingface/transformers/releases/tag/v5.0.0rc3"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/3c77bb97-e493-493d-9a88-c57f5c536485"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-69w3-r845-3855"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-6rvg-6v2m-4j46","slug":"ghsa-6rvg-6v2m-4j46-e04ee614","dossier":false,"summary":"Transformers Regular Expression Denial of Service (ReDoS) vulnerability","aliases":["CVE-2024-12720","PYSEC-2026-1982"],"sourceIds":["GHSA-6rvg-6v2m-4j46","PYSEC-2026-1982"],"published":"2025-03-20T12:32:43Z","modified":"2026-07-07T17:56:13.229192922Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12720"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/deac971c469bcbb182c2e52da0b82fb3bf54cccf"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/4bed1214-7835-4252-a853-22bbad891f98"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6rvg-6v2m-4j46"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-887c-mr87-cxwp","slug":"ghsa-887c-mr87-cxwp-233a2961","dossier":false,"summary":"PyTorch Improper Resource Shutdown or Release vulnerability","aliases":["BIT-pytorch-2025-3730","CVE-2025-3730","PYSEC-2026-1970"],"sourceIds":["GHSA-887c-mr87-cxwp","PYSEC-2026-1970"],"published":"2025-04-16T21:30:59Z","modified":"2026-07-14T16:44:12.813190902Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3730"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/150835"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/pull/150981"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/01f226bfb8f2c343f5c614a6bbf685d91160f3af"},{"type":"WEB","url":"https://github.com/timocafe/tewart-pytorch/commit/46fc5d8e360127361211cb237d5f9eef0223e567"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.305076"},{"type":"WEB","url":"https://vuldb.com/?id.305076"},{"type":"WEB","url":"https://vuldb.com/?submit.553645"},{"type":"PACKAGE","url":"https://pypi.org/project/torch"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-887c-mr87-cxwp"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-9356-575x-2w9m","slug":"ghsa-9356-575x-2w9m-908a1f8c","dossier":false,"summary":"Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability","aliases":["CVE-2025-5197","PYSEC-2026-1983"],"sourceIds":["GHSA-9356-575x-2w9m","PYSEC-2026-1983"],"published":"2025-08-06T12:31:20Z","modified":"2026-07-07T17:57:12.881673492Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5197"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/701caef704e356dc2f9331cc3fd5df0eccb4720a"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/944b56000be5e9b61af8301aa340838770ad8a0b"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/3f8b3fd0-166b-46e7-b60f-60dd9d2678bf"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9356-575x-2w9m"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-c678-jfcj-6jmf","slug":"ghsa-c678-jfcj-6jmf-cd9a8774","dossier":false,"summary":"PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument","aliases":["BIT-pytorch-2025-2148","CVE-2025-2148","PYSEC-2025-189"],"sourceIds":["GHSA-c678-jfcj-6jmf"],"published":"2025-03-10T12:30:55Z","modified":"2026-06-09T21:26:06.844649427Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2148"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/147722"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-189.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/blob/b0a67c7495bb11ecb23e556058db059ba48354af/torch/autograd/profiler.py#L990"},{"type":"WEB","url":"https://vuldb.com/?ctiid.299059"},{"type":"WEB","url":"https://vuldb.com/?id.299059"},{"type":"WEB","url":"https://vuldb.com/?submit.505959"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-f4hp-rmr7-r7v8","slug":"ghsa-f4hp-rmr7-r7v8-fe038cb7","dossier":false,"summary":"PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function","aliases":["BIT-pytorch-2025-2998","CVE-2025-2998","PYSEC-2025-192"],"sourceIds":["GHSA-f4hp-rmr7-r7v8"],"published":"2025-03-31T15:30:48Z","modified":"2026-06-09T22:11:09.050788278Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2998"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149622"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149622#issue-2935495265"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/494518046816d29099b7d056a74ffa5c244fdcdd"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-192.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.302047"},{"type":"WEB","url":"https://vuldb.com/?id.302047"},{"type":"WEB","url":"https://vuldb.com/?submit.524151"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-fgcw-684q-jj6r","slug":"ghsa-fgcw-684q-jj6r-9fe55ba1","dossier":false,"summary":"huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path","aliases":["CVE-2026-5241","PYSEC-2026-2290"],"sourceIds":["GHSA-fgcw-684q-jj6r","PYSEC-2026-2290"],"published":"2026-06-03T14:16:46.337Z","modified":"2026-07-16T23:59:26.091024755Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5241"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-5241"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484384"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2026-2290.yaml"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-fpwr-67px-3qhx","slug":"ghsa-fpwr-67px-3qhx-94f30126","dossier":false,"summary":"Transformers Regular Expression Denial of Service (ReDoS) vulnerability","aliases":["CVE-2025-1194","PYSEC-2026-1984"],"sourceIds":["GHSA-fpwr-67px-3qhx","PYSEC-2026-1984"],"published":"2025-04-29T12:30:21Z","modified":"2026-07-07T17:57:12.290933710Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1194"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/92c5ca9dd70de3ade2af2eb835c96215cc50e815"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/86f58dcd-683f-4adc-a735-849f51e9abb2"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fpwr-67px-3qhx"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-hxxf-235m-72v3","slug":"ghsa-hxxf-235m-72v3-21da19b0","dossier":false,"summary":"Deserialization of Untrusted Data in Hugging Face Transformers","aliases":["CVE-2024-11394","PYSEC-2024-229"],"sourceIds":["GHSA-hxxf-235m-72v3","PYSEC-2024-229"],"published":"2024-11-22T22:15:07Z","modified":"2026-06-10T17:02:30.328718397Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11394"},{"type":"WEB","url":"https://github.com/huggingface/transformers/issues/34840"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/35296"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2024-229.yaml"},{"type":"WEB","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1515"},{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1515/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hxxf-235m-72v3"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-jjph-296x-mrcr","slug":"ghsa-jjph-296x-mrcr-0f661d67","dossier":false,"summary":"Transformers vulnerable to ReDoS attack through its get_imports() function","aliases":["CVE-2025-3264","PYSEC-2026-1985"],"sourceIds":["GHSA-jjph-296x-mrcr","PYSEC-2026-1985"],"published":"2025-07-07T12:30:22Z","modified":"2026-07-07T17:56:51.899728258Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3264"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/3c6f7822-9992-476d-8cf0-b0b1623427df"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jjph-296x-mrcr"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-phhr-52qp-3mj4","slug":"ghsa-phhr-52qp-3mj4-6f5d82e3","dossier":false,"summary":"Transformers's Improper Input Validation vulnerability can be exploited through username injection","aliases":["CVE-2025-3777","PYSEC-2026-1986"],"sourceIds":["GHSA-phhr-52qp-3mj4","PYSEC-2026-1986"],"published":"2025-07-07T12:30:22Z","modified":"2026-07-07T17:56:47.225461188Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3777"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/huggingface/transformers/blame/a7d2bbaaa8aac64f7c1ee8c1421cfe84b38359a4/src/transformers/image_utils.py"},{"type":"WEB","url":"https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-phhr-52qp-3mj4"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-q2wp-rjmx-x6x9","slug":"ghsa-q2wp-rjmx-x6x9-43135d3d","dossier":false,"summary":"Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking","aliases":["CVE-2025-3263","PYSEC-2026-1987"],"sourceIds":["GHSA-q2wp-rjmx-x6x9","PYSEC-2026-1987"],"published":"2025-07-07T12:30:22Z","modified":"2026-07-07T17:56:57.889099913Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3263"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/c7a69150-54f8-4e81-8094-791e7a2a0f29"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q2wp-rjmx-x6x9"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-qfhq-4f3w-5fph","slug":"ghsa-qfhq-4f3w-5fph-33bc3f14","dossier":false,"summary":"PyTorch is vulnerable to memory corruption through its torch.lstm_cell function","aliases":["BIT-pytorch-2025-3001","CVE-2025-3001","PYSEC-2025-195"],"sourceIds":["GHSA-qfhq-4f3w-5fph"],"published":"2025-03-31T18:31:08Z","modified":"2026-06-10T18:26:26.736808954Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3001"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149626"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149626#issue-2935860995"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/999d94b5ede5f4ec111ba7dd144129e2c2725b03"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-195.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.302050"},{"type":"WEB","url":"https://vuldb.com/?id.302050"},{"type":"WEB","url":"https://vuldb.com/?submit.524212"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu"],"packageCount":1,"repositoryCount":9},{"id":"GHSA-qq3j-4f4f-9583","slug":"ghsa-qq3j-4f4f-9583-cd76c72c","dossier":false,"summary":"Hugging Face Transformers Regular Expression Denial of Service","aliases":["CVE-2025-2099","PYSEC-2025-40"],"sourceIds":["GHSA-qq3j-4f4f-9583","PYSEC-2025-40"],"published":"2025-05-19T12:15:19Z","modified":"2026-06-10T17:02:48.111891265Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2099"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/36648"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/8cb522b4190bd556ce51be04942720650b1a3e57"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2025-40.yaml"},{"type":"WEB","url":"https://huntr.com/bounties/97b780f3-ffca-424f-ad5d-0e1c57a5bde4"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qq3j-4f4f-9583"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-qxrp-vhvm-j765","slug":"ghsa-qxrp-vhvm-j765-63c6e9a2","dossier":false,"summary":"Deserialization of Untrusted Data in Hugging Face Transformers","aliases":["CVE-2024-11392","PYSEC-2024-227"],"sourceIds":["GHSA-qxrp-vhvm-j765","PYSEC-2024-227"],"published":"2024-11-22T22:15:06Z","modified":"2026-06-10T17:02:35.857656186Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11392"},{"type":"WEB","url":"https://github.com/huggingface/transformers/issues/34840"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/35296"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2024-227.yaml"},{"type":"WEB","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1513"},{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1513/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qxrp-vhvm-j765"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-rcv9-qm8p-9p6j","slug":"ghsa-rcv9-qm8p-9p6j-edc1db04","dossier":false,"summary":"Hugging Face Transformers library has Regular Expression Denial of Service","aliases":["CVE-2025-6051","PYSEC-2026-1988"],"sourceIds":["GHSA-rcv9-qm8p-9p6j","PYSEC-2026-1988"],"published":"2025-09-14T18:30:26Z","modified":"2026-07-07T17:56:51.178415128Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6051"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/38844"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/54a02160eb030da9be18231c77791f2eb3a52216"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/ba8eaba9865618253f997784aa565b96206426f0"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/af929523-7b59-418a-bf55-301830b2ac9d"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rcv9-qm8p-9p6j"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-rrmf-rvhw-rf47","slug":"ghsa-rrmf-rvhw-rf47-389d8330","dossier":false,"summary":"PyTorch is vulnerable to memory corruption through its torch.jit.script function","aliases":["BIT-pytorch-2025-3000","CVE-2025-3000","PYSEC-2025-194"],"sourceIds":["GHSA-rrmf-rvhw-rf47"],"published":"2025-03-31T15:30:48Z","modified":"2026-07-17T17:15:51.452848951Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3000"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149623"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149623#issue-2935703015"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/b90c94991cdf8b87c8f7439f79518e0ef2c4ca4f"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-194.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.302049"},{"type":"WEB","url":"https://vuldb.com/?id.302049"},{"type":"WEB","url":"https://vuldb.com/?submit.524197"}],"versionKeys":["pypi:torch@2.10.0","pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-vgrw-7cvw-pwgx","slug":"ghsa-vgrw-7cvw-pwgx-766c6098","dossier":false,"summary":"PyTorch is vulnerable to memory corruption through its unpack_sequence function","aliases":["BIT-pytorch-2025-2999","CVE-2025-2999","PYSEC-2025-193"],"sourceIds":["GHSA-vgrw-7cvw-pwgx"],"published":"2025-03-31T15:30:48Z","modified":"2026-06-10T17:41:15.774477397Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2999"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149622"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149622#issue-2935495265"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/494518046816d29099b7d056a74ffa5c244fdcdd"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-193.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.302048"},{"type":"WEB","url":"https://vuldb.com/?id.302048"},{"type":"WEB","url":"https://vuldb.com/?submit.524198"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-wrfc-pvp9-mr9g","slug":"ghsa-wrfc-pvp9-mr9g-c6b03ddf","dossier":false,"summary":"Deserialization of Untrusted Data in Hugging Face Transformers","aliases":["CVE-2024-11393","PYSEC-2024-228"],"sourceIds":["GHSA-wrfc-pvp9-mr9g","PYSEC-2024-228"],"published":"2024-11-22T22:15:07Z","modified":"2026-06-10T17:00:13.252500033Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11393"},{"type":"WEB","url":"https://github.com/huggingface/transformers/issues/34840"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/35296"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2024-228.yaml"},{"type":"WEB","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1514"},{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1514/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wrfc-pvp9-mr9g"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-x3gm-94wq-g975","slug":"ghsa-x3gm-94wq-g975-a197ba31","dossier":false,"summary":"PyTorch: Manipulation of the argument scale/zero_point leads to improper initialization via Quantized Sigmoid Module","aliases":["BIT-pytorch-2025-2149","CVE-2025-2149","PYSEC-2025-190"],"sourceIds":["GHSA-x3gm-94wq-g975"],"published":"2025-03-10T15:30:47Z","modified":"2026-06-09T22:11:08.734544854Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2149"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/147818"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/147818#issue-2877301660"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-190.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.299060"},{"type":"WEB","url":"https://vuldb.com/?id.299060"},{"type":"WEB","url":"https://vuldb.com/?submit.506563"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":2},{"id":"PYSEC-2025-198","slug":"pysec-2025-198-62b25ed4","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46148","CVE-2025-46148"],"sourceIds":["PYSEC-2025-198"],"published":"2025-09-25T15:16:12.007Z","modified":"2026-05-20T09:19:19.437232Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/65a587a579dfdff887b9b35bb79b9093"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151198"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/152993"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":2},{"id":"PYSEC-2025-199","slug":"pysec-2025-199-c528cb5a","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46149","CVE-2025-46149"],"sourceIds":["PYSEC-2025-199"],"published":"2025-09-25T15:16:12.153Z","modified":"2026-05-20T09:19:19.498677Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/147848"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/147961"}],"versionKeys":["pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-200","slug":"pysec-2025-200-d11172cd","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46150","CVE-2025-46150"],"sourceIds":["PYSEC-2025-200"],"published":"2025-09-25T15:16:12.303Z","modified":"2026-05-20T09:19:19.559970Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/141538"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/141538#issuecomment-2537424658"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/144395"}],"versionKeys":["pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-201","slug":"pysec-2025-201-c002b022","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46152","CVE-2025-46152"],"sourceIds":["PYSEC-2025-201"],"published":"2025-09-25T15:16:12.470Z","modified":"2026-05-20T09:19:19.618679Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/143555"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/143635"}],"versionKeys":["pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-202","slug":"pysec-2025-202-f0ff1751","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46153","CVE-2025-46153"],"sourceIds":["PYSEC-2025-202"],"published":"2025-09-25T15:16:12.603Z","modified":"2026-05-20T09:19:19.678555Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/pytorch/pytorch/compare/v2.6.0...v2.7.0"},{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/e636f2e7a306105b7e96809e2b85c28a"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/142853"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/143460"}],"versionKeys":["pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-203","slug":"pysec-2025-203-2febb201","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55551","CVE-2025-55551"],"sourceIds":["PYSEC-2025-203"],"published":"2025-09-25T15:16:12.887Z","modified":"2026-05-20T09:19:19.739357Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151401"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0"],"packageCount":1,"repositoryCount":8},{"id":"PYSEC-2025-204","slug":"pysec-2025-204-cdae47da","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55552","CVE-2025-55552"],"sourceIds":["PYSEC-2025-204"],"published":"2025-09-25T16:15:34.320Z","modified":"2026-05-20T09:19:19.802802Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/147847"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0"],"packageCount":1,"repositoryCount":8},{"id":"PYSEC-2025-205","slug":"pysec-2025-205-fd5e58fd","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55553","CVE-2025-55553"],"sourceIds":["PYSEC-2025-205"],"published":"2025-09-25T16:15:34.460Z","modified":"2026-05-20T09:19:19.866970Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151432"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/154645"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-206","slug":"pysec-2025-206-58322476","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55554","CVE-2025-55554"],"sourceIds":["PYSEC-2025-206"],"published":"2025-09-25T16:15:34.593Z","modified":"2026-05-20T09:19:19.928295Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151510"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0"],"packageCount":1,"repositoryCount":8},{"id":"PYSEC-2025-207","slug":"pysec-2025-207-2abef3fc","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55557","CVE-2025-55557"],"sourceIds":["PYSEC-2025-207"],"published":"2025-09-25T16:15:34.833Z","modified":"2026-05-20T09:19:19.989717Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151738"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/151931"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-208","slug":"pysec-2025-208-6e93fe9d","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55558","CVE-2025-55558"],"sourceIds":["PYSEC-2025-208"],"published":"2025-09-25T16:15:34.960Z","modified":"2026-05-20T09:19:20.054109Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151523"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/151887"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-209","slug":"pysec-2025-209-e6f352b0","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55560","CVE-2025-55560"],"sourceIds":["PYSEC-2025-209"],"published":"2025-09-25T16:15:35.197Z","modified":"2026-05-20T09:19:20.117285Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151522"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/151897"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-211","slug":"pysec-2025-211-d8bd15de","dossier":false,"summary":null,"aliases":["CVE-2025-14920"],"sourceIds":["PYSEC-2025-211"],"published":"2025-12-23T21:15:47.183Z","modified":"2026-05-21T15:00:32.080516132Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1150/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-212","slug":"pysec-2025-212-a011b97d","dossier":false,"summary":null,"aliases":["CVE-2025-14921"],"sourceIds":["PYSEC-2025-212"],"published":"2025-12-23T21:15:47.340Z","modified":"2026-05-21T15:00:32.052313357Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1149/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-213","slug":"pysec-2025-213-9043dc9b","dossier":false,"summary":null,"aliases":["CVE-2025-14924"],"sourceIds":["PYSEC-2025-213"],"published":"2025-12-23T21:15:47.600Z","modified":"2026-05-21T15:00:32.048516839Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1141/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-214","slug":"pysec-2025-214-eb241255","dossier":false,"summary":null,"aliases":["CVE-2025-14926"],"sourceIds":["PYSEC-2025-214"],"published":"2025-12-23T21:15:47.857Z","modified":"2026-05-21T15:00:32.929011749Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1147/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-215","slug":"pysec-2025-215-6064f491","dossier":false,"summary":null,"aliases":["CVE-2025-14927"],"sourceIds":["PYSEC-2025-215"],"published":"2025-12-23T21:15:47.987Z","modified":"2026-05-21T15:00:32.888290877Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1148/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-216","slug":"pysec-2025-216-5708ed01","dossier":false,"summary":null,"aliases":["CVE-2025-14928"],"sourceIds":["PYSEC-2025-216"],"published":"2025-12-23T21:15:48.110Z","modified":"2026-05-21T15:00:32.939311939Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1146/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-217","slug":"pysec-2025-217-2c1ad388","dossier":false,"summary":null,"aliases":["CVE-2025-14929"],"sourceIds":["PYSEC-2025-217"],"published":"2025-12-23T21:15:48.240Z","modified":"2026-05-21T15:00:24.271970226Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1144/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":8},{"id":"PYSEC-2025-218","slug":"pysec-2025-218-39811fc3","dossier":false,"summary":null,"aliases":["CVE-2025-14930"],"sourceIds":["PYSEC-2025-218"],"published":"2025-12-23T21:15:48.367Z","modified":"2026-05-21T15:00:33.791364554Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1145/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.3","pypi:transformers@4.53.1","pypi:transformers@4.57.1"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2026-139","slug":"pysec-2026-139-96951ff6","dossier":false,"summary":null,"aliases":["BIT-pytorch-2026-4538","CVE-2026-4538"],"sourceIds":["PYSEC-2026-139"],"published":"2026-03-22T05:16:20.273Z","modified":"2026-05-21T15:00:31.962442644Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pytorch/pytorch/"},{"type":"ADVISORY","url":"https://vuldb.com/?id.352326"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.774681"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.352326"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/176791"}],"versionKeys":["pypi:torch@2.10.0","pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu"],"packageCount":1,"repositoryCount":10},{"id":"PYSEC-2026-2286","slug":"pysec-2026-2286-8795b007","dossier":false,"summary":null,"aliases":["BIT-pytorch-2026-24747","CVE-2026-24747","GHSA-63cw-57p8-fm3p","PYSEC-2026-1856"],"sourceIds":["PYSEC-2026-2286"],"published":"2026-01-27T22:15:56.470Z","modified":"2026-07-13T07:26:23.701611780Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-24747"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24747.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://github.com/pytorch/pytorch/releases/tag/v2.10.0"},{"type":"ADVISORY","url":"https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433612"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/163105"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/163122/commit/954dc5183ee9205cbe79876ad05dd2d9ae752139"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu"],"packageCount":1,"repositoryCount":9}]}}