Tensorflow

Vendor:

First CVE: Apr 23, 2019 · Active for 7 years

432

Total CVEs

More Total CVEs than 100% of tracked products

61.7

Avg CVEs / Year

Higher CVE frequency than 99% of tracked products

6.9

Avg CVSS

Higher Avg CVSS than 40% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Tensorflow over time

Volume of CVEsAvg CVSS Base Score

First CVE

Apr 23, 2019

7 years ago

Most Recent CVE

Sep 25, 2025

302 days ago

CVE Severity & Scoring

Tensorflow432 CVEs

41%

54%

All CVEs352,231 CVEs

45%

40%

11%

LowMediumHighCritical

Attack Vector

Local232 (53.7%)

Network200 (46.3%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low418 (96.8%)

High14 (3.2%)

Unknown0 (0.0%)

User Interaction

None425 (98.4%)

Unknown0 (0.0%)

Required7 (1.6%)

Privileges Required

Low287 (66.4%)

High0 (0.0%)

None145 (33.6%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (432 CVEs).

432 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2023-25664CRITICAL TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, there is a heap buffer overflow in TAvgPoolGrad. A fix is included in TensorFlow 2.	Mar 25, 2023	9.8	31	NO	NO
CVE-2022-35939CRITICAL TensorFlow is an open source platform for machine learning. The `ScatterNd` function takes an input argument that determines the indices of of the output tensor. An input index gre	Sep 16, 2022	9.8	31	NO	NO
CVE-2022-35937CRITICAL TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater	Sep 16, 2022	9.1	30	NO	NO
CVE-2022-23587CRITICAL Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for c	Feb 4, 2022	9.8	30	NO	NO
CVE-2020-15208CRITICAL In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside o	Sep 25, 2020	9.8	30	NO	NO
CVE-2020-15205CRITICAL In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `data_splits` argument of `tf.raw_ops.StringNGrams` lacks validation. This allows a user to pass values tha	Sep 25, 2020	9.8	30	NO	NO
CVE-2019-16778CRITICAL In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and num_segments fields ar	Dec 16, 2019	9.8	30	NO	NO
CVE-2018-7575CRITICAL Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. The type of exploitation is context-dependent.	Apr 24, 2019	9.8	30	NO	NO
CVE-2022-41900CRITICAL TensorFlow is an open source platform for machine learning. The security vulnerability results in FractionalMax(AVG)Pool with illegal pooling_ratio. Attackers using Tensorflow can	Nov 18, 2022	9.8	29	NO	NO
CVE-2022-35938CRITICAL TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater	Sep 16, 2022	9.1	29	NO	NO

View all 432 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (432 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

0 CVEs

0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (432 CVEs).

Media Mentions

Signals from CVEs in this product scope (432 CVEs).

Top CNAs Publishing CVEs For Tensorflow

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS
2.9.0	26	5.8	0.3%
2.8.0	24	5.8	0.3%
2.7.0	87	6.5	0.5%
2.6.0	67	6.5	0.2%
2.5.0	57	6.5	0.2%
2.4.0	1	7.5	0.7%
2.3.0	8	6.2	0.7%
2.2.0	3	5.6	0.7%
2.18.0	2	7.0	0.2%
2.10.0	13	7.9	0.4%
2.10	59	7.6	0.4%