Ultralytics 10 CVEs in 4 Ultralytics products, including Ultralytics, Fastsam, Yolov3. Newest: CVE-2026-118619 (2026-10-28).
Ultralytics products with known CVEs Ultralytics CVEs — newest first CVE Severity Score Published Summary CVE-2026-118619High 8.82026-10-28 Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… CVE-2026-118618High 7.82026-10-28 Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… CVE-2026-118617High 7.82026-10-28 Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… CVE-2026-118616High 7.82026-10-28 Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… CVE-2026-118615High 7.82026-10-28 Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affe… CVE-2026-118614High 7.82026-10-28 Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec… CVE-2026-118613High 7.82026-10-28 Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… CVE-2026-111237Medium 5.32026-10-16 A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_modelmeta.custom_me… CVE-2021-31681High 7.82023-07-31 Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml file. CVE-2021-31680High 7.82023-07-31 Deserialization of Untrusted Data vulnerability in yolo 5 allows attackers to execute arbitrary code via crafted yaml file.