repository icon
keras-team / keras Project repository

Deep Learning for humans

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN58 DAYS

FIX

WITHIN97 DAYS

Incomplete Fix CVE-2026-1669 - Arbitrary File Read via HDF5 VDS External Links K...
9to5ai
self closed
Incomplete Fix CVE-2026-1669 - Arbitrary File Read via HDF5 VDS External Links K...
9to5ai
self closed
Incomplete Fix CVE-2026-1669 - Arbitrary File Read via HDF5 VDS External Links K...
9to5ai
self closed
Incomplete Fix CVE-2026-1669 - Arbitrary File Read via HDF5 VDS External Links K...
9to5ai
self closed
Incomplete Fix CVE-2026-1669 - Arbitrary File Read via HDF5 Virtual Datasets Ext...
9to5ai
self closed
Incomplete Fix CVE-2026-1669 - Arbitrary File Read via HDF5 VDS External Links K...
9to5ai
self closed
test
sark4
self closed
Arbitrary Code Execution via Insecure Deserialization of Lambda Layers in load_m...
finddabugs
duplicate
High
Keras tar extraction allows write outside current extraction directory(Tar-Slip)
asim-qazi
duplicate
High
Bypass of filter_safe_tarinfos via empty-name tar member in extract_open_archive
psdat123
duplicate
High
Arbitrary Code Execution via marshal.loads() in python_utils.py — CWE-94 Bytecod...
theoddesseyp-ai
not applicable
Arbitrary Code Execution via torch.load(weights_only=False) in TorchModuleWrappe...
theoddesseyp-ai
spam
Server-Side Request Forgery (SSRF) in RemoteMonitor Callback via Unvalidated URL...
elucidator-hky
self closed
Path traversal safety check bypass in is_path_in_dir() due to unsafe startswith(...
elucidator-hky
self closed
Pickle deserialization hardcodes safe_mode=False in __reduce__, bypassing safe m...
odysseypro25-project
self closed
Unsafe Deserialization via Lambda layer in Keras model loading
etwithin
duplicate
High
Unsafe Deserialization via torch.load(weights_only=False) in TorchModuleWrapper
nakosec
duplicate
High
Remote Code Execution (RCE) via Insecure Lambda Layer Deserialization in Keras
sebas5207418
spam
[CRITICAL] Remote Code Execution via Insecure Deserialization (CWE-502) in Keras...
akhmittra
duplicate
High
Remote Denial of Service via Unbounded Tensor Allocation in .keras Models
hyperps1
informative
High
Unsafe np.load(allow_pickle=True) in Dataset Loaders leads to Remote Code Execut...
mia-718ai
duplicate
High
Arbitrary Code Execution via Malicious Lambda Layer in Keras .keras Model Deseri...
amadhan882
duplicate
High
TFSMLayer bypasses `safe_mode=True`, allowing attacker-controlled code execution...
0xmanan
High
•$900•CVE-2026-1462
Arbitrary Code Execution via TorchModuleWrapper during Model Load
ajithkelangath
duplicate
Critical
Uncontrolled Resource Consumption via Zip Bomb in keras.utils.get_file
yasinseyhun
pending
Remote code execution by exploiting a vulnerable GitHub workflow
seljak00vac
self closed
Insecure Deserialization via Custom Object Injection in Keras Model Loading
1bdool492
duplicate
High
Multiple Denial-of-Service Vulnerabilities in keras.src.backend.tensorflow.image...
hyperps1
pending
Critical Denial-of-Service via Malicious .keras Model (HDF5 Shape Bomb Causes Pe...
hyperps
pending
Runtime Code Execution via Keras Lambda Layers Bypassing Safe Mode Protection
hyperps
duplicate
Critical
Code Injection via Keras Lambda Layer Leading to RCE
hyperps1
duplicate
Critical
Insecure Deserialization (RCE) via joblib Loader in python\_utils.func\_load
advisory1-lab
informative
High
Code Execution via Lambda Layer Deserialization When safe_mode=False
perfecxion-ai
self closed
Critical rce
shemshallah
spam
Path Traversal via load_img in keras
neineit
pending
Path Traversal vulnerability in keras using tar extract
ready-research
High
•$750•CVE-2025-12638
Unsafe Deserialization in Keras `load_model()` and `deserialize_keras_object()`...
msr123dsjsja-l
duplicate
High
Inference Backdoor in Keras via .h5 Model with Triggered Output Manipulation
b33l238u8
pending
TAR Slip via Path Traversal in Archive Extraction
kerkroups
pending
Deserialization of Untrusted Data
ceballosm
pending
Keras model load RCE in keras_native
azraelxuemo
pending
Arbitrary File Write Via "keras.utils.get_file" API
ngockhanhc311
informative
Critical
Malicious Keras Model Leads to RCE
legoclones
informative
Critical
Use of a Broken or Risky Cryptographic Algorithm
hob1t
spam
Insecure Temporary File
nhienit2010
informative
High
Insecure Temporary File
nhienit2010
self closed
Inefficient Regular Expression Complexity
eduflowz
spam
Arbitrary Code Execution Vulnerability in Pillow's ImageMath Module (CVE-2022-22...
saintsconnor
spam
Multiple insecure temporary files
blueudp
not applicable
Code Injection
arjunshibu
pending