CVE-2026-44484
PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.39%
- CWE
- CWE-506
- Published
- 2026-05-14
- Last modified
- 2026-07-15
Affected products
- Lightning-AI pytorch-lightning
- Lightning-AI pytorch-lightning
Weakness type
Related vulnerabilities
- CVE-2026-74232 — Zbtlink MQWrt yunmgrd Cloud C2 Implant
- CVE-2026-77651 — The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project...
- CVE-2026-77650 — The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a...
- CVE-2026-77649 — The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a...
- CVE-2026-73532 — Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build
- CVE-2026-73533 — Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build
- CVE-2026-48161 — react18-use was vulnerable to malicious code execution via compromised commits
- CVE-2026-48160 — react-tracked was vulnerable to malicious code execution via compromised commits