# cve.now: Paddlepaddle

The newest entries naming Paddlepaddle as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-108961](https://cve.now/CVE-2026-108961.md): PaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.\_\_init\_\_ code injection (CVSS 5.3)
- [CVE-2026-10800](https://cve.now/CVE-2026-10800.md): PaddlePaddle FastDeploy MultimodalHasher hasher.py hash\_features weak hash (CVSS 2.0)
- [CVE-2024-1603](https://cve.now/CVE-2024-1603.md): confirmed (CVSS 8.2)
- [CVE-2024-0818](https://cve.now/CVE-2024-0818.md): Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6 (CVSS 9.1)
- [CVE-2024-0917](https://cve.now/CVE-2024-0917.md): remote code execution in paddlepaddle/paddle 2.6.0 (CVSS 9.4)
- [CVE-2024-0815](https://cve.now/CVE-2024-0815.md): Command injection in paddle.utils.download.\_wget\_download (bypass filter) in paddlepaddle/paddle 2.6.0 (CVSS 9.3)
- [CVE-2024-0817](https://cve.now/CVE-2024-0817.md): Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0 (CVSS 9.3)
- [CVE-2024-0521](https://cve.now/CVE-2024-0521.md): Code Injection in paddlepaddle/paddle (CVSS 9.3)
- [CVE-2023-52314](https://cve.now/CVE-2023-52314.md): Command injection in convert\_shape\_compare (CVSS 9.6)
- [CVE-2023-52313](https://cve.now/CVE-2023-52313.md): FPE in paddle.argmin and paddle.argmax (CVSS 4.7)
- [CVE-2023-52312](https://cve.now/CVE-2023-52312.md): Null pointer dereference in paddle.crop (CVSS 4.7)
- [CVE-2023-52311](https://cve.now/CVE-2023-52311.md): Command injection in \_wget\_download (CVSS 9.6)
- [CVE-2023-52310](https://cve.now/CVE-2023-52310.md): Command injection in get\_online\_pass\_interval (CVSS 9.6)
- [CVE-2023-52309](https://cve.now/CVE-2023-52309.md): Heap buffer overflow in paddle.repeat\_interleave (CVSS 8.2)
- [CVE-2023-52308](https://cve.now/CVE-2023-52308.md): FPE in paddle.amin (CVSS 4.7)
- [CVE-2023-52307](https://cve.now/CVE-2023-52307.md): Stack overflow in paddle.linalg.lu\_unpack (CVSS 8.2)
- [CVE-2023-52306](https://cve.now/CVE-2023-52306.md): FPE in paddle.lerp (CVSS 4.7)
- [CVE-2023-52305](https://cve.now/CVE-2023-52305.md): FPE in paddle.topk (CVSS 4.7)
- [CVE-2023-52304](https://cve.now/CVE-2023-52304.md): Stack overflow in paddle.searchsorted (CVSS 8.2)
- [CVE-2023-52303](https://cve.now/CVE-2023-52303.md): Segfault in paddle.put\_along\_axis (CVSS 4.7)
- [CVE-2023-52302](https://cve.now/CVE-2023-52302.md): Segfault in paddle.nextafter (CVSS 4.7)
- [CVE-2023-38678](https://cve.now/CVE-2023-38678.md): Segfault in paddle.mode (CVSS 4.7)
- [CVE-2023-38677](https://cve.now/CVE-2023-38677.md): FPE in paddle.linalg.eig (CVSS 4.7)
- [CVE-2023-38676](https://cve.now/CVE-2023-38676.md): Segfault in paddle.dot (CVSS 4.7)
- [CVE-2023-38675](https://cve.now/CVE-2023-38675.md): FPE in paddle.linalg.matrix\_rank (CVSS 4.7)
- [CVE-2023-38674](https://cve.now/CVE-2023-38674.md): FPE in paddle.nanmedian (CVSS 4.7)
- [CVE-2023-38673](https://cve.now/CVE-2023-38673.md): Command injection in fs.py (CVSS 9.6)
- [CVE-2023-38672](https://cve.now/CVE-2023-38672.md): FPE in paddle.linalg.matrix\_power (CVSS 4.7)
- [CVE-2023-38671](https://cve.now/CVE-2023-38671.md): Heap buffer overflow in paddle.trace (CVSS 8.3)
- [CVE-2023-38670](https://cve.now/CVE-2023-38670.md): Null pointer dereference in paddle.flip (CVSS 4.7)
- [CVE-2023-38669](https://cve.now/CVE-2023-38669.md): Use after free in paddle.diagonal in PaddlePaddle before 2.5.0. (CVSS 8.3)
- [CVE-2022-46742](https://cve.now/CVE-2022-46742.md): Code injection in paddle.audio.functional.get\_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution. (CVSS 10.0)
- [CVE-2022-46741](https://cve.now/CVE-2022-46741.md): Out-of-bounds read in gather\_tree in PaddlePaddle before 2.4. (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/paddlepaddle
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.