Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-1839,CVE-2025-14920, CVE-2026-4372

Summary IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-1839,CVE-2025-14920,CVE-2026-4372. This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2025-14920 DESCRIPTION: Huggi...

CVE-2026-1839 vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, py3-transformers, text-generation-inference, tritonserver-backend-vllm-cuda-12.9, nemo, lmcache-cuda-12.8...

aiforthechurch (0.1.0), attention-sinks (>=0.2.2, <=0.4.0) +12 more potentially affected by CVE-2026-1839 via transformers (4.34.0)

transformers PYPI version 4.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aiforthechurch 0.1.0 - attention-sinks =0.2.2, =0.1.66, =2.2.0, =0.0.13, =0.1.0, =0.1.0, =0.2.0rc8, =1.0.0, =0.1.0, =0.2.0 - urag 0.0.1...

antimatter (0.1.3), autotrain-advanced (>=0.6.42, <=0.6.44) +12 more potentially affected by CVE-2026-1839 via transformers (4.34.1)

transformers PYPI version 4.34.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - antimatter 0.1.3 - autotrain-advanced =0.6.42, =4.3.0, =1.22.0rc1, =1.0.1, =0.1.69, =0.1.73 - spacy-transformers 1.3.2 Source cves:...

adapters (>=0.0.0.dev20231123, <=0.1.1), aiconfig-extension-llama-guard (>=0.0.1, <=0.0.3) +51 more potentially affected by CVE-2026-1839 via transformers (4.35.2)

transformers PYPI version 4.35.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adapters =0.0.0.dev20231123, =0.0.1, =0.2.0, =0.6.45, =2.24.4, =0.1.1, =0.1.3, =0.1.105, =1.23.0rc1, =0.1.0rc1, =0.0.5, =1.0.4 and more...

autotrain-advanced (>=0.6.95, <=0.7.1), dialogy (>=0.10.4, <=2.2.5) +10 more potentially affected by CVE-2026-1839 via transformers (4.38.0)

transformers PYPI version 4.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.6.95, =0.10.4, =1.7.0, =0.0.1, =0.10.9, =0.1.0, =0.1.17, =0.1.20 - profanity-sanitizer 0.1.4 - team-comm-tools...

auto-ner (>=0.1.0, <=0.1.2), cog-hf-template (0.0.2) +10 more potentially affected by CVE-2026-1839 via transformers (4.32.1)

transformers PYPI version 4.32.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - auto-ner =0.1.0, =0.1.0, =0.0.5, =3.4.4, =1.0.0, =1.20.0rc1, =0.0.3, =1.0.8, =0.0.1, =0.0.9 Source cves: CVE-2026-1839 Source advisory:...

allencv (>=0.1.2, <=0.1.3), allennlp (>=1.4.0, <=2.0.2.dev20210209) +25 more potentially affected by CVE-2026-1839 via transformers (4.2.2)

transformers PYPI version 4.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allencv =0.1.2, =1.4.0, =0.0.3, =1.4.0, =0.0.3, =1.0.0, =0.0.1, =0.0.4, =0.3.4, =0.1.0, =0.2.0 - model-hub 0.1.0.dev0 and more Source...

name-entity-extraction-for-contextual-embedding (>=0.3.0, <=0.5.0) potentially affected by CVE-2026-1839 via transformers (4.2.0)

transformers PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - name-entity-extraction-for-contextual-embedding =0.3.0, =0.5.0 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...

autotrain-advanced (>=0.7.53, <=0.7.63), codontransformer (>=0.1.0, <=0.2.0) +13 more potentially affected by CVE-2026-1839 via transformers (4.40.0)

transformers PYPI version 4.40.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.7.53, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.0, =2.9.0, =2.9.0, =0.1.0, =0.1.6 - wafl-llm 0.0.83 Source cves:...

azureml-metrics (0.0.25.post1), deepinfer (0.1.0) +11 more potentially affected by CVE-2026-1839 via transformers (4.50.0)

transformers PYPI version 4.50.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - azureml-metrics 0.0.25.post1 - deepinfer 0.1.0 - deepvisiontools =0.1.0, =0.7.0, =1.1.0, =1.4.0, =0.6.3, =0.1.0, =0.10.4, =0.11.0 Sourc...

appcategorizer (>=0.1.0, <=0.2.2), bicleaner-ai (>=3.3.1, <=3.4.0) +38 more potentially affected by CVE-2026-1839 via transformers (4.52.4)

transformers PYPI version 4.52.4 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - appcategorizer =0.1.0, =3.3.1, =0.1.1, =0.5.7, =0.2.13, =3.0.0, =3.0.0rc1, =0.4.0, =0.1.1, =1.1.0, =0.0.3, =0.0.6 and more Source cves:...

adapters (1.0.1), agent-driftwatch (>=0.1.0, <=0.2.5) +69 more potentially affected by CVE-2026-1839 via transformers (4.45.2)

transformers PYPI version 4.45.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adapters 1.0.1 - agent-driftwatch =0.1.0, =0.1.0, =0.6.2.post1, =4.3.0, =0.0.2, =1.0.0, =0.1.9, =2.1.1rc2, =0.1.1, =1.0.0, =5.1.6,...

chain-guardrail (>=0.0.10, <=0.0.11), dulu (0.1.4) +10 more potentially affected by CVE-2026-1839 via transformers (4.42.3)

transformers PYPI version 4.42.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - chain-guardrail =0.0.10, =0.1.3, =1.0.1, =0.0.5, =0.3.4, =1.0.0, =2.5.9, =2.6.2 Source cves: CVE-2026-1839 Source advisory:...

banglanlptoolkit (>=1.1.7.dev4, <=1.1.8), contextqa (>=2.0.0, <=2.0.5) +27 more potentially affected by CVE-2026-1839 via transformers (4.42.4)

transformers PYPI version 4.42.4 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - banglanlptoolkit =1.1.7.dev4, =2.0.0, =0.0.71, =0.0.1b2, =0.5.0rc0, =0.2.0, =1.0.0, =0.9.3, =0.1.0, =1.0.0, =0.1.0, =0.1.1 and more...

ai-dynamo (>=0.7.0, <=0.7.1), aitraining (>=0.0.2, <=0.0.6) +39 more potentially affected by CVE-2026-1839 via transformers (4.57.1)

transformers PYPI version 4.57.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-dynamo =0.7.0, =0.0.2, =0.2.1, =1.0.0a1, =1.2.6, =2026.1.0rc2, =0.1.3, =2.1.21, =0.5.2.post1, =1.3.5, =1.5.0 and more Source cves:...

bacpipe (>=1.1.0, <=1.3.0), certora-patrol (>=0.1.3, <=0.1.17) +9 more potentially affected by CVE-2026-1839 via transformers (4.56.0)

transformers PYPI version 4.56.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - bacpipe =1.1.0, =0.1.3, =0.1.18, =0.2.1a0, =0.3.2, =1.0.0, =0.1.0, =0.1.1 Source cves: CVE-2026-1839 Source advisory:...

avalan (1.1.6), karma-medeval (>=0.1.0, <=0.2.0) +11 more potentially affected by CVE-2026-1839 via transformers (4.53.0)

transformers PYPI version 4.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - avalan 1.1.6 - karma-medeval =0.1.0, =0.3.1, =0.0.1.2, =0.2.0, =0.9.0, =0.2.0, =0.2.2, =0.0.3, =0.0.4 - unimeth 0.0.2 -...

aitraining (>=0.0.7, <=0.0.49), bookvox (>=0.5.0, <=0.5.2) +49 more potentially affected by CVE-2026-1839 via transformers (4.57.3)

transformers PYPI version 4.57.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aitraining =0.0.7, =0.5.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.0.11, =0.9.0, =0.4.0, =0.3.2, =0.4.0 and more Source cves: CVE-2026-1839...

adapters (1.0.0), airunner (>=3.0.0, <=3.1.7) +13 more potentially affected by CVE-2026-1839 via transformers (4.43.4)

transformers PYPI version 4.43.4 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adapters 1.0.0 - airunner =3.0.0, =1.5.3, =0.0.10, =0.0.0, =0.11.0, =0.1.2, =0.4.6, =2.2.4, =1.21.3, =1.13.0, =1.18.2, =1.0.7, =1.1.14 ...