GHSA-36rr-ww3j-vrjv: The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.

GHSA-w5fx-fh39-j5rw: Codex has sandbox bypass due to bug in path configuration logic

GHSA-g4rr-88fc-26fj: Grafana-Zabbix ReDoS vulnerability

GHSA-36fq-jgmw-4r9c: Keras is vulnerable to Deserialization of Untrusted Data

GHSA-77wq-646f-jrm2: Duplicate Advisory: The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0.

**transformers has a Deserialization of Untrusted Data vulnerability**

Critical severity GitHub Reviewed Published Dec 19, 2023 to the GitHub Advisory Database • Updated Dec 28, 2023

Headline

GHSA-3863-2447-669p: transformers has a Deserialization of Untrusted Data vulnerability

ghsa: Latest News