CVE-2026-12484: A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle d

A vulnerability in Keras (a machine learning library) version 3.15.0 allows attackers to run arbitrary code by sending malicious data to the `keras.layers.TorchModuleWrapper.from_config` method. The method uses `torch.load` (a function that reconstructs PyTorch objects from saved data) with unsafe settings by default, and doesn't require users to explicitly opt into safe mode before processing untrusted configurations.