#deserialization
-
Inference Server CVEs: vLLM, Ollama, llama.cpp, Triton
The serving layer now outproduces model files for critical CVEs. Verified entries in vLLM, Ollama, llama.cpp and Triton, and the three defects behind them.
-
MLflow CVEs: Why 2.14.1 Still Fails Your Scanner
MLflow carries 80 published advisories and 17 with no patched version. Why scanning 2.14.1 returns unfixable findings, and which ones need real action.
-
LangChain Security Vulnerabilities 2026: CVEs and What to Patch
Four verified CVEs in LangChain and LangGraph expose API secrets, files, and chat history. CVSS scores, attack paths, and the patched versions to run.
-
PyTorch Security: Notable CVEs and Hardening the Loading Path
PyTorch's most consequential CVEs cluster on one thing: loading a model file that runs code. A walk through the verified entries and how to harden.
-
Unsafe Model Deserialization: The Pickle Problem Behind ML CVEs
Loading a model file can execute arbitrary code. The most repeated vulnerability class in the ML supply chain: the real CVEs, why they recur, and what fixes it.