Dao-ailab

    Dashboard / Vendors

    Products: 1
    Vulnerabilities: 3
    Known Exploited: 0
    0
    Critical Level Threats
    2
    High Level Threats
    1
    Medium Level Threats
    0
    Low Level Threats

    Vulnerabilities

    100806040200
    JanFebMarAprMayJunJulAugSepOctNovDec
    Critical Level Threats
    High Level Threats
    Medium Level Threats
    Low Level Threats

    Products Security index

    Actions
    Items Per Page

    Vulnerabilities

    CVE-2026-62239

    FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py

    Last Modified: Jul 14, 2026
    Published: Jul 13, 2026

    CVE-2026-31253

    The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted checkpoint file. When a victim loads this checkpoint during model warmstarting or evaluation, arbitrary code is executed on the victim's system.

    Last Modified: May 12, 2026
    Published: May 11, 2026

    CVE-2026-31254

    flash‑attention Training Script Allows Arbitrary Code Execution via eval Resolver

    Last Modified: May 12, 2026
    Published: May 11, 2026
    Items Per Page
    Dao-Ailab Vulnerabilities & Security CVEs | CVE-DB