ML Stack CVE Filter

Every CVE ID in this table was re-checked against the NVD API on 19 August 2026. That pass removed 45 entries: 9 whose IDs are not published in NVD at all (three of those were malformed variants such as CVE-2025-32434b), 3 that had been withdrawn by their CNA, and 33 whose NVD record describes an unrelated product. It corrected 44 CVSS base scores, re-attributed 6 entries to the correct package, and added 33 entries, 27 of them covering the inference-serving runtimes (Ollama, vLLM, llama.cpp). CVSS values here are the base score NVD publishes: NVD's own CVSS v3.1 analysis where one exists, otherwise the CNA's score. Those two can differ by more than a point - NVD scores the 2024 llama.cpp GGUF overflows 9.8 where Cisco Talos, the CNA, scored them 8.8 - so a scanner quoting CNA numbers will not always match this table. Affected and fixed version ranges come from the linked advisory and were NOT independently re-derived, so confirm the range against NVD or the vendor advisory before making a remediation decision. Some MLflow and Ray entries have no patched version upstream; those are mitigations-only. On 16 September 2026 four further entries were added after individual NVD checks: CVE-2026-24747 (PyTorch, memory corruption reachable through the weights_only unpickler, fixed in 2.10.0), CVE-2025-49655 and CVE-2025-12058 (Keras, fixed in 3.11.3 and 3.12.0 respectively, so the two have different affected ranges), and CVE-2025-55559 (TensorFlow 2.18.0 Conv2D denial of service, for which NVD records no fixed version). On 8 October 2026 the CVE-2025-12058 fix was corrected to Keras 3.12.0 (there is no 3.11.4 release), and three Langflow entries were added from the CISA KEV catalog: CVE-2025-3248, CVE-2026-33017 and CVE-2026-55255. Their CVSS scores were not re-checked against NVD in that pass, so they show as unscored here and are not hidden by the severity filter; read the score on the linked NVD record.