Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-1839,CVE-2025-14920, CVE-2026-4372

Summary IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-1839,CVE-2025-14920,CVE-2026-4372. This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2025-14920 DESCRIPTION: Huggi...

langchain-timbr (>=2.1.0, <=3.3.0), otat (>=0.1.0, <=0.1.3) +5 more potentially affected by CVE-2026-1839 via transformers (4.57.0)

transformers PYPI version 4.57.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - langchain-timbr =2.1.0, =0.1.0, =1.0.1, =0.5.3rc2, =1.1.4, =0.0.1, =0.1.3 - vllm-kunlun 0.11.1 Source cves: CVE-2026-1839 Source...

allencv (>=0.1.2, <=0.1.3), allennlp (>=1.4.0, <=2.0.2.dev20210209) +25 more potentially affected by CVE-2026-1839 via transformers (4.2.2)

transformers PYPI version 4.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allencv =0.1.2, =1.4.0, =0.0.3, =1.4.0, =0.0.3, =1.0.0, =0.0.1, =0.0.4, =0.3.4, =0.1.0, =0.2.0 - model-hub 0.1.0.dev0 and more Source...

azureml-metrics (0.0.25.post1), deepvisiontools (>=0.1.0, <=0.2.0) +10 more potentially affected by CVE-2026-1839 via transformers (4.50.0)

transformers PYPI version 4.50.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - azureml-metrics 0.0.25.post1 - deepvisiontools =0.1.0, =0.7.0, =1.1.0, =1.4.0, =0.6.3, =0.1.0, =0.10.4, =0.11.0 Source cves:...

open-rag-eval (>=0.2.4, <=0.3.0) potentially affected by CVE-2026-1839 via transformers (4.50.2)

transformers PYPI version 4.50.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - open-rag-eval =0.2.4, =0.3.0 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...

aait (>=1.0.0.0, <=2.3.14), adapters (1.2.0) +86 more potentially affected by CVE-2026-1839 via transformers (4.51.3)

transformers PYPI version 4.51.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aait =1.0.0.0, =0.3.16, =0.1.0, =0.6.1, =0.1.0, =0.1.1, =0.1.122 - colpali-engine 0.3.10 - coqui-tts 0.26.2 - dadmatools 2.3.0 and more...

aiagents4pharma (>=0.0.0, <=1.49.1), aiagents4pharma-ansh (0.0.0) +9 more potentially affected by CVE-2026-1839 via transformers (4.55.2)

transformers PYPI version 4.55.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aiagents4pharma =0.0.0, =0.2.3, =0.1.0, =0.7.0, =0.3.8, =0.4.6 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...

allennlp (>=1.2.0rc1.dev20200924, <=1.2.0rc1.dev20200929) potentially affected by CVE-2026-1839 via transformers (3.2.0)

transformers PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.2.0rc1.dev20200924, =1.2.0rc1.dev20200929 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...

smaberta (>=0.0.1, <=0.0.2), trl (0.0.2) potentially affected by CVE-2026-1839 via transformers (2.6.0)

transformers PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - smaberta =0.0.1, =0.0.2 - trl 0.0.2 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...

booknlp2 (>=1.0.0, <=1.0.1), classy-core (>=0.1.0.dev20211019, <=0.2.1) +10 more potentially affected by CVE-2026-1839 via transformers (4.11.3)

transformers PYPI version 4.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - booknlp2 =1.0.0, =0.1.0.dev20211019, =0.1.0, =1.2.0, =0.3.0, =1.1.0.dev4, =1.1.0, =1.2.0 - zensols-mednlp 0.0.1 Source cves:...

augly-jp (>=2021.9.6, <=2021.9.26), biome-text (3.3.0) +10 more potentially affected by CVE-2026-1839 via transformers (4.9.2)

transformers PYPI version 4.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - augly-jp =2021.9.6, =1.2.1, =0.1.0, =1.0.4, =1.0.6 - tkittagger 0.0.0.2 - wafl 0.0.1 - zero-shot-re 0.0.4 Source cves: CVE-2026-1839...

aihandler (>=1.8.20, <=1.9.1), aimet-torch (1.31.1) +16 more potentially affected by CVE-2026-1839 via transformers (4.27.4)

transformers PYPI version 4.27.4 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aihandler =1.8.20, =3.0.0, =0.2.0, =0.9.0, =1.0.4, =0.0.1, =0.0.1.post3, =0.0.1, =0.0.34, =0.0.39 and more Source cves: CVE-2026-1839...

deepspeed-mii (>=0.0.1, <=0.0.2), farm-haystack (>=1.9.0rc1, <=1.11.1) +5 more potentially affected by CVE-2026-1839 via transformers (4.21.2)

transformers PYPI version 4.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - deepspeed-mii =0.0.1, =1.9.0rc1, =1.0.0, =0.2.13.dev20230218132015, =0.1.5, =0.0.2, =0.0.7 Source cves: CVE-2026-1839 Source advisory:...

adapters (0.1.2), azureml-automl-dnn-nlp (1.55.0) +64 more potentially affected by CVE-2026-1839 via transformers (4.36.2)

transformers PYPI version 4.36.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adapters 0.1.2 - azureml-automl-dnn-nlp 1.55.0 - bcembedding =0.1.4, =0.1.0, =0.2.2, =0.0.1, =1.0.0, =0.3.4, =0.0.1rc7, =1.0.18, =0.0.1...

alignment-handbook (0.1.0), geniebottle (0.0.3) +7 more potentially affected by CVE-2026-1839 via transformers (4.37.1)

transformers PYPI version 4.37.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - alignment-handbook 0.1.0 - geniebottle 0.0.3 - llm-docstring-generator 1.0.0 - lmdeploy =0.2.3, =0.0.2, =0.0.6, =0.0.7 - video2dataset...

larch-readme (0.0.10), psycop-feature-generation (>=0.2.2, <=0.17.1) +2 more potentially affected by CVE-2026-1839 via transformers (4.23.0)

transformers PYPI version 4.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - larch-readme 0.0.10 - psycop-feature-generation =0.2.2, =0.12.1, =0.22.1 Source cves: CVE-2026-1839 Source advisory:...

ammico-lavis (>=1.0.2.1, <=1.0.2.2), aniemore (1.2.3) +35 more potentially affected by CVE-2026-1839 via transformers (4.26.1)

transformers PYPI version 4.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ammico-lavis =1.0.2.1, =0.6.3b20230204, =0.0.2, =0.0.4, =0.6.1, =0.0.1, =0.1.1, =1.6.0.dev202305310417, =0.0.1, =2.0.0, =2.1.1 and more...

grandmaster (>=0.0.3, <=0.0.5), neumai (>=0.0.9, <=0.0.36) +2 more potentially affected by CVE-2026-1839 via transformers (4.27.3)

transformers PYPI version 4.27.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - grandmaster =0.0.3, =0.0.9, =0.0.17, =0.0.5, =0.1.1 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...

cog-hf-template (>=0.0.3, <=0.0.5), dbgpt-hub (0.3.1) +9 more potentially affected by CVE-2026-1839 via transformers (4.33.2)

transformers PYPI version 4.33.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - cog-hf-template =0.0.3, =0.1.4, =0.3.0, =2.0.14, =0.1.1, =0.1.5 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...

adv-bible-search (>=0.1.0, <=0.1.1), bert-squeeze (>=0.1.0, <=0.1.1) +9 more potentially affected by CVE-2026-1839 via transformers (4.29.0)

transformers PYPI version 4.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adv-bible-search =0.1.0, =0.1.0, =1.0.0, =0.3.11, =0.4.0, =0.1.3, =0.2.1, =2.0.0, =0.0.8, =0.0.9 Source cves: CVE-2026-1839 Source...