Filtered by vendor Linuxfoundation Subscriptions
Total 394 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-55560 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2025-10-14 7.5 High
An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is compiled by Inductor.
CVE-2025-59345 2 Dragonflyoss, Linuxfoundation 2 Dragonfly2, Dragonfly 2025-10-13 9.1 Critical
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, delete, and modify jobs, and create preheat jobs. An unauthenticated adversary with network access to a Manager web UI uses /api/v1/jobs endpoint to create hundreds of useless jobs. The Manager is in a denial-of-service state, and stops accepting requests from valid administrators. This vulnerability is fixed in 2.1.0.
CVE-2025-51480 2 Linuxfoundation, Onnx 2 Onnx, Onnx 2025-10-08 8.8 High
Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted external_data.location paths containing traversal sequences, bypassing intended directory restrictions.
CVE-2025-55552 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2025-10-03 5.3 Medium
pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.
CVE-2025-55553 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2025-10-03 7.5 High
A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).
CVE-2025-55554 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2025-10-03 5.3 Medium
pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nan_to_num-.long().
CVE-2025-55557 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2025-10-03 7.5 High
A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS).
CVE-2025-55558 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2025-10-03 7.5 High
A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() and is compiled by Inductor, leading to a Denial of Service (DoS).
CVE-2025-46148 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2025-10-03 5.3 Medium
In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.
CVE-2025-46149 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2025-10-03 5.3 Medium
In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error.
CVE-2025-46150 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2025-10-03 5.3 Medium
In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results.
CVE-2025-46152 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2025-10-03 5.3 Medium
In PyTorch before 2.7.0, bitwise_right_shift produces incorrect output for certain out-of-bounds values of the "other" argument.
CVE-2025-46153 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2025-10-03 5.3 Medium
PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU implementation, negatively affecting nn.Dropout1d, nn.Dropout2d, and nn.Dropout3d for fallback_random=True.
CVE-2025-55551 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2025-10-03 7.5 High
An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation.
CVE-2024-40635 2 Debian, Linuxfoundation 2 Debian Linux, Containerd 2025-10-02 4.6 Medium
containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
CVE-2025-47290 1 Linuxfoundation 1 Containerd 2025-09-19 5.9 Medium
containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
CVE-2025-47291 1 Linuxfoundation 1 Containerd 2025-09-19 7.5 High
containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not honored. This may cause a denial of service of the Kubernetes node. This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should update to these versions to resolve the issue. As a workaround, disable usernamespaced pods in Kubernetes temporarily.
CVE-2025-59346 2 Dragonflyoss, Linuxfoundation 2 Dragonfly2, Dragonfly 2025-09-18 5.3 Medium
Dragonfly is an open source P2P-based file distribution and image acceleration system. Versions prior to 2.1.0 contain a server-side request forgery (SSRF) vulnerability that enables users to force DragonFly2’s components to make requests to internal services that are otherwise not accessible to them. The issue arises because the Manager API accepts a user-supplied URL when creating a Preheat job with weak validation, peers can trigger other peers to fetch an arbitrary URL through pieceManager.DownloadSource, and internal HTTP clients follow redirects, allowing a request to a malicious server to be redirected to internal services. This can be used to probe or access internal HTTP endpoints. The vulnerability is fixed in version 2.1.0.
CVE-2025-59347 2 Dragonflyoss, Linuxfoundation 2 Dragonfly2, Dragonfly 2025-09-18 6.5 Medium
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The Manager disables TLS certificate verification in HTTP clients. The clients are not configurable, so users have no way to re-enable the verification. A Manager processes dozens of preheat jobs. An adversary performs a network-level Man-in-the-Middle attack, providing invalid data to the Manager. The Manager preheats with the wrong data, which later causes a denial of service and file integrity problems. This vulnerability is fixed in 2.1.0.
CVE-2025-59348 2 Dragonflyoss, Linuxfoundation 2 Dragonfly2, Dragonfly 2025-09-18 7.5 High
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the processPieceFromSource method does not update the structure’s usedTraffic field, because an uninitialized variable n is used as a guard to the AddTraffic method call, instead of the result.Size variable. A task is processed by a peer. The usedTraffic metadata is not updated during the processing. Rate limiting is incorrectly applied, leading to a denial-of-service condition for the peer. This vulnerability is fixed in 2.1.0.