PyPIPackage

ludwig

2 known vulnerabilities (2 critical), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-31238Critical 9.8
The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) in its model serving component.
Affected: through 0.10.4.
Fixed in 0.11.0 (released Feb 27, 2026, 74 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.17.10, is not affected.
CVE-2026-31237Critical 9.8
The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) through its predict() method.
Affected: through 0.10.4.
Fixed in 0.11.0 (released Feb 27, 2026, 74 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.17.10, is not affected.