Onnx (Linuxfoundation) - vulnerabilities (CVEs)
12 CVEs, 0 in the last 30 days, 36 known versions, newest CVE from 2026-08-21. Vendor: Linuxfoundation.
CVEs of Onnx
- CVE-2026-49114 - CVSS 7.1 (high), 2026-08-21: In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for…
- CVE-2026-44512 - CVSS 5.5 (medium), 2026-07-08: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0,…
- CVE-2026-34445 - CVSS 8.6 (high), 2026-04-01: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was…
- CVE-2026-34447 - CVSS 5.5 (medium), 2026-04-01: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is a symlink traversal…
- CVE-2026-34446 - CVSS 5.5 (medium), 2026-04-01: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the…
- CVE-2026-27489 - CVSS 8.7 (high), 2026-04-01: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via…
- CVE-2026-28500 - CVSS 9.1 (critical), 2026-03-18: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control…
- CVE-2025-51480 - CVSS 8.8 (high), 2025-07-22: Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted…
- CVE-2024-5187 - CVSS 8.8 (high), 2024-06-06: A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to…
- CVE-2024-27318 - CVSS 7.5 (high), 2024-02-23: Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path…
- CVE-2024-27319 - CVSS 9.1 (critical), 2024-02-23: Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one…
- CVE-2022-25882 - CVSS 7.5 (high), 2023-01-26: Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file…
