keras-team keras-team/keras
10 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-12570 | unspecified – < 3.12.3, 3.15.0 | Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-9335 | unspecified – < 3.12.3, 3.15.0 | Improper Handling of HDF5 ExternalLinks in keras-team/keras | MEDIUM 6.5 | 0.8 % | ||
| CVE-2026-12484 | unspecified – latest | Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config | HIGH 7.8 | 0.3 % | ||
| CVE-2026-12482 | unspecified – latest | Path Traversal via Symlink Name Validation Bypass in keras-team/keras | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-12481 | unspecified – latest | Deserialization of Untrusted Data in keras-team/keras | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-12480 | unspecified – < 3.12.2, 3.14.1 | Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-12479 | unspecified – latest | Path Traversal in keras-team/keras | MEDIUM 6.1 | 0.4 % | ||
| CVE-2026-11816 | unspecified – < 3.14.0 | Path Traversal in keras-team/keras | HIGH 8.1 | 0.6 % | ||
| CVE-2026-1462 | unspecified – < 3.13.2 | Safe Mode Bypass in keras-team/keras | HIGH 7.8 | 0.4 % | ||
| CVE-2025-12638 | unspecified – latest | Path Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file() | HIGH 8.0 | 0.7 % |