ZDI Advisories

DeepSpeed

DeepSpeed is a deep learning optimization library developed by Microsoft for training large-scale AI models.

NVIDIA

NVIDIA, a leading manufacturer of graphics processors and AI computing hardware, has a high-severity local vulnerability (CVSS 7.8) that requires…

npm

npm is the largest package manager for JavaScript and Node.js, used by millions of developers worldwide.

NVIDIA

NVIDIA is a major technology company known for graphics processors, AI chips, and data center hardware.

Hugging Face

Hugging Face is a well-known AI/machine learning platform that provides pretrained models and collaborative tools for developers.

Intel

Intel, a major semiconductor and processor manufacturer, has a high-severity local vulnerability (CVSS 7.8) that requires user interaction but no…

MLflow

MLflow is an open-source machine learning platform used for experiment tracking and model management.

verl

This advisory concerns a high-severity vulnerability (CVSS 7.8) in Verl, a lesser-known vendor product.

Microsoft

Microsoft has a medium-severity information disclosure vulnerability (CVSS 4.3) that can be exploited remotely by an unauthenticated attacker through…

Hugging Face

Hugging Face is a well-known AI/ML platform that hosts machine learning models and provides collaborative tools for developers.

npm

npm is the JavaScript package manager and repository used by millions of developers worldwide.

verl

A high-severity vulnerability (CVSS 7.8) has been discovered in Verl, affecting the confidentiality, integrity, and availability of systems.

Fuji Electric

Fuji Electric, a major Japanese manufacturer of industrial automation and power systems equipment, has a high-severity local privilege escalation…

Fuji Electric

Fuji Electric, a major Japanese industrial automation and power systems manufacturer, has a medium-severity vulnerability (CVSS 5.5) in one of their…

NoMachine

NoMachine, a remote desktop and access software vendor, has a high-severity vulnerability (CVSS 7.1) that requires local access and low-level user…

DriveLock

DriveLock is a German endpoint security and data protection company known for device control and encryption solutions.

Krita

Krita is a popular open-source digital painting and illustration software.

DriveLock

DriveLock is a German endpoint security and data protection vendor.

Krita

Krita is a widely-used open-source digital painting and illustration software.

Krita

Krita is a popular open-source digital painting and illustration software application.

DriveLock

DriveLock is a German endpoint security and data protection vendor.

DriveLock

DriveLock is a German endpoint security and data protection vendor.

NoMachine

NoMachine, a remote desktop and access software provider, has a high-severity vulnerability (CVSS 7.8) that requires local access and low-level user…

Krita

Krita is a free, open-source digital painting and illustration software commonly used by artists and designers.

DriveLock

DriveLock is a German endpoint security and data protection software vendor.

Krita

Krita is a popular open-source digital painting and illustration software application.

Delta Electronics

Delta Electronics, a major manufacturer of power supplies and industrial automation components, has a high-severity vulnerability (CVSS 7.8) that…

Ashlar-Vellum

Ashlar-Vellum is a software company known for CAD and design tools.

NI

National Instruments (NI) has a high-severity local vulnerability (CVSS 7.8) that requires user interaction but no authentication, allowing an…

QEMU

QEMU is a widely-used open-source virtualization platform that emulates hardware to run virtual machines.