CVE-2026-44484

CriticalCVSS 9.8/10Last modified Nov 11, 2026

Description

PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-506CWE-829

Affected software

VendorProductVersions
Lightning-AIpytorch-lightning2.6.2; 2.6.3
Red HatRed Hat AI Inference Server—
Red HatRed Hat AI Inference Server—
Red HatRed Hat AI Inference Server—
Red HatRed Hat AI Inference Server—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat OpenShift AI (RHOAI)—

References

Timeline

Published
May 14, 2026
Last modified
Nov 11, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-444867.5Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy creCVE-2026-444877.5Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a ProCVE-2026-444887.5Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request andCVE-2026-444895.3Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.gCVE-2026-44498.8Use after free in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafCVE-2026-444908.2Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollutioCVE-2026-444928.6Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addrCVE-2026-444948.7Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a PrototypCVE-2026-444957.7Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollutioCVE-2026-444967.5Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x CVE-2026-444979.1ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-CVE-2026-444987.5ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations
CVE-2026-44484: Critical severity, CVSS 9.8 | Vulnix