deserialization
0 live · 40 on record · last incident 16 days ago
Records40
- closed8.1Langflow CVE-2026-104317: IBM Langflow OSS Deserialization Vulnerability
Patch now · Disclosed · since 29 Oct 2026 · CVE-2026-104317
AI - closed6.5MLflow CVE-2026-115886: MLflow GenAI scorer endpoints allow unsafe deserialization
Patch now · Disclosed · since 23 Oct 2026 · CVE-2026-115886
AI - closed7.5Langflow CVE-2026-93447: IBM Langflow OSS vulnerable to insecure deserialization
Patch now · Disclosed · since 7 Oct 2026 · CVE-2026-93447
AI - closed4.1LangChain4j CVE-2026-97869: LangChain4j deserialization flaw in AgenticScopeSerializer
Patch now · Disclosed · since 25 Sep 2026 · CVE-2026-97869
AI - closed6.9llama.cpp CVE-2026-86317: Assertion failure in ggml-org llama.cpp RPC server
Patch now · Disclosed · since 7 Sep 2026 · CVE-2026-86317
AI - closed7.3llama.cpp CVE-2026-78147: llama.cpp RPC server vulnerable to insecure deserialization
Patch now · Disclosed · since 23 Aug 2026 · CVE-2026-78147
AI - closed9.8ComfyUI + custom nodes CVE-2026-68771: ComfyUI Unsafe Deserialization in Training Dataset Node
Patch now · Disclosed · since 31 Jul 2026 · CVE-2026-68771
AI - closed9.8Hugging Face libraries CVE-2026-68770: sentence-transformers local model loading remote code execution vulnerability
Patch now · Disclosed · since 31 Jul 2026 · CVE-2026-68770
AI - closed7.8NVIDIA TensorRT-LLM CVE-2026-47472: NVIDIA TensorRT-LLM IPC Deserialization Vulnerability
Patch now · Disclosed · since 14 Jul 2026 · CVE-2026-47472
AI - closed8.4NVIDIA TensorRT-LLM CVE-2026-24233: NVIDIA TensorRT-LLM Unsafe Model Weight Deserialization
Patch now · Disclosed · since 14 Jul 2026 · CVE-2026-24233
AI - closed7.8NVIDIA NeMo CVE-2026-24228: NVIDIA NeMo Framework vulnerable to insecure deserialization
Patch now · Disclosed · since 16 Jun 2026 · CVE-2026-24228
AI - closed7.8Hugging Face libraries HuggingFace transformers vulnerable to remote code execution via config.json
Patch now · Disclosed · since 26 May 2026 · CVE-2026-4372
AI - closed7.1LangChain family CVE-2026-45134: LangSmith SDK insecure prompt manifest deserialization
Patch now · Disclosed · since 13 May 2026 · updated 27 May 2026 · CVE-2026-45134
AI - closed8.2LangChain family CVE-2026-44843: LangChain vulnerable to unsafe deserialization
Patch now · Disclosed · since 8 May 2026 · updated 26 May 2026 · CVE-2026-44843
AI - closed8.8Langflow IBM Langflow Desktop Insecure Deserialization Vulnerability
Patch now · Disclosed · since 8 Apr 2026 · CVE-2026-3357
AI - closed6.8LangChain family CVE-2026-28277: LangGraph Unsafe Msgpack Checkpoint Deserialization
Patch now · Disclosed · since 5 Mar 2026 · CVE-2026-28277
AI - closed7.5Langflow CVE-2026-0772: Langflow Disk Cache Deserialization RCE Vulnerability
Patch now · Disclosed · since 23 Jan 2026 · CVE-2026-0772
AI - closed8.4LlamaIndex CVE-2024-14021: LlamaIndex unsafe deserialization vulnerability
Patch now · Disclosed · since 12 Jan 2026 · CVE-2024-14021
AI - closed7.8Hugging Face libraries Hugging Face Transformers Megatron GPT2 Deserialization RCE
Patch now · Disclosed · since 23 Dec 2025 · CVE-2025-14924
AI - closed7.8Hugging Face libraries Hugging Face Transformers Perceiver Model Deserialization RCE
Patch now · Disclosed · since 23 Dec 2025 · CVE-2025-14920
AI - closed7.8Hugging Face libraries Hugging Face Transformers GLM4 Deserialization RCE
Patch now · Disclosed · since 23 Dec 2025 · CVE-2025-14930
AI - closed7.8Hugging Face libraries Hugging Face Transformers Transformer-XL Deserialization RCE
Patch now · Disclosed · since 23 Dec 2025 · CVE-2025-14921
AI - closed7.8Hugging Face libraries CVE-2025-14929: Hugging Face Transformers Deserialization Vulnerability
Patch now · Disclosed · since 23 Dec 2025 · CVE-2025-14929
AI - closed8.6LangChain family LangChain JS serialization injection vulnerability CVE-2025-68665
Patch now · Disclosed · since 23 Dec 2025 · CVE-2025-68665
AI - closed9.3LangChain family LangChain serialization injection vulnerability CVE-2025-68664
Patch now · Disclosed · since 23 Dec 2025 · CVE-2025-68664
AI - closed7.8NVIDIA NeMo CVE-2025-23303: NVIDIA NeMo Framework Deserialization Vulnerability
Patch now · Disclosed · since 13 Aug 2025 · CVE-2025-23303
AI - closed5.0LlamaIndex LlamaIndex vulnerable to remote code execution in JsonPickleSerializer
Patch now · Disclosed · since 7 Jul 2025 · CVE-2025-3108
AI - closed7.6NVIDIA NeMo CVE-2025-23249: Deserialization Vulnerability in NVIDIA NeMo Framework
Patch now · Disclosed · since 22 Apr 2025 · CVE-2025-23249
AI - closedHugging Face libraries Malicious Models with Embedded Malware Discovered on Hugging Face
Supply chain · Exploited · since 2025 (approx.)
AI - closed9.8vLLM CVE-2024-11041: vLLM Deserialization of Untrusted Data vulnerability
Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-11041
AI - closed9.8vLLM CVE-2024-9053: vLLM Pickle Deserialization Remote Code Execution
Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-9053
AI - closed9.8vLLM CVE-2024-9052: vLLM Deserialization Vulnerability in GroupCoordinator
Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-9052
AI - closed9.0vLLM CVE-2025-29783: vLLM allows remote code execution via Mooncake integration
Patch now · Disclosed · since 19 Mar 2025 · CVE-2025-29783
AI - closed8.8Hugging Face libraries CVE-2024-11394: Deserialization vulnerability in Hugging Face Transformers
Patch now · Disclosed · since 23 Nov 2024 · updated 23 Nov 2024 · CVE-2024-11394
AI - closed8.8Hugging Face libraries CVE-2024-11393: Deserialization vulnerability in Hugging Face Transformers
Patch now · Disclosed · since 23 Nov 2024 · updated 23 Nov 2024 · CVE-2024-11393
AI - closed7.5Hugging Face libraries CVE-2024-11392: Deserialization vulnerability in Hugging Face Transformers
Patch now · Disclosed · since 23 Nov 2024 · updated 23 Nov 2024 · CVE-2024-11392
AI - closed8.4LangChain family CVE-2024-5998: LangChain pickle deserialization of untrusted data
Patch now · Disclosed · since 17 Sep 2024 · CVE-2024-5998
AI - closed3.4Hugging Face libraries Hugging Face Transformers Deserialization Remote Code Execution
Patch now · Disclosed · since 10 Apr 2024 · CVE-2024-3568
AI - closed7.8Hugging Face libraries CVE-2023-7018: Deserialization vulnerability in Hugging Face transformers
Patch now · Disclosed · since 20 Dec 2023 · CVE-2023-7018
AI - closed9.0Hugging Face libraries CVE-2023-6730: Deserialization vulnerability in Hugging Face transformers
Patch now · Disclosed · since 19 Dec 2023 · CVE-2023-6730
AI