Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-1839,CVE-2025-14920, CVE-2026-4372

Summary IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-1839,CVE-2025-14920,CVE-2026-4372. This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2025-14920 DESCRIPTION: Huggi...

CVE-2026-4372 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, text-generation-inference, nemo...

slp (>=1.2.0, <=1.2.1) potentially affected by CVE-2026-4372 via transformers (4.3.0)

transformers PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - slp =1.2.0, =1.2.1 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

aces-metric (>=0.0.3, <=0.0.4), adaptor (>=0.2.3, <=0.2.5) +51 more potentially affected by CVE-2026-4372 via transformers (4.30.2)

transformers PYPI version 4.30.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aces-metric =0.0.3, =0.2.3, =0.0.1, =0.0.6, =0.0.1, =0.1.1, =2.3.0, =0.1.3, =2.7.0, =0.10.3, =0.1.2, =0.2.0, =0.3.1 and more Source cve...

codegaze (0.0.23a0), deep-copilot (>=0.0.5, <=0.0.8) +13 more potentially affected by CVE-2026-4372 via transformers (4.21.3)

transformers PYPI version 4.21.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - codegaze 0.0.23a0 - deep-copilot =0.0.5, =0.3.2, =0.0.1, =0.0.1a0, =0.0.1, =0.2.1, =0.20.0 - spacy-transformers 1.1.8 -...

arelight (0.24.0), bicleaner-ai (2.0.0rc2) +25 more potentially affected by CVE-2026-4372 via transformers (4.24.0)

transformers PYPI version 4.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - arelight 0.24.0 - bicleaner-ai 2.0.0rc2 - bnaug =1.0.0.dev0, =2.0.4, =0.0.0, =0.8.7a0, =1.0.0, =0.0.3, =0.0.1, =1.1.25, =1.2.28 and mor...

dlk (>=0.0.1, <=0.0.4), pyannotators-trfclassifier (>=0.5.79, <=0.5.85) +5 more potentially affected by CVE-2026-4372 via transformers (4.12.0)

transformers PYPI version 4.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - dlk =0.0.1, =0.5.79, =0.5.182, =0.5.39, =0.5.185, =0.5.98, =0.5.55, =0.5.59 Source cves: CVE-2026-4372 Source advisory:...

nepali-sentiment-analysis (>=0.1.0, <=1.0.0) potentially affected by CVE-2026-4372 via transformers (4.16.1)

transformers PYPI version 4.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - nepali-sentiment-analysis =0.1.0, =1.0.0 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

enot-autodl (>=3.3.1, <=3.4.3), farm-haystack (1.5.0) +6 more potentially affected by CVE-2026-4372 via transformers (4.19.2)

transformers PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - enot-autodl =3.3.1, =0.7.2, =0.2.0, =2.1.0, =2.1.2 - textdiversity 0.0.1 Source cves: CVE-2026-4372 Source advisory:...

blanc (>=0.1.0, <=0.1.5) potentially affected by CVE-2026-4372 via transformers (2.4.0)

transformers PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - blanc =0.1.0, =0.1.5 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

alignment-handbook (0.2.0), decoders (0.1.0) +12 more potentially affected by CVE-2026-4372 via transformers (4.35.0)

transformers PYPI version 4.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - alignment-handbook 0.2.0 - decoders 0.1.0 - dragon-baseline =0.1.0, =0.1.0, =0.3.1, =0.0.14, =0.1.2, =0.82.0, =0.1.0, =0.1.0, =0.9.2,...

axolotl (0.5.0), buzz-captions (1.2.0) +11 more potentially affected by CVE-2026-4372 via transformers (4.46.1)

transformers PYPI version 4.46.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - axolotl 0.5.0 - buzz-captions 1.2.0 - fastvideo =0.0.1.dev0, =2.0.21, =0.1.1, =0.4.6, =0.1.0, =0.0.3.post1, =0.0.4 - xcodec2-infer-lib...

aiagents4pharma (>=1.6.0, <=1.44.0), aitraining (>=0.0.0, <=0.8.37.dev0) +29 more potentially affected by CVE-2026-4372 via transformers (4.48.0)

transformers PYPI version 4.48.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aiagents4pharma =1.6.0, =0.0.0, =0.8.35, =1.0.0, =0.3.5, =4.5.0, =0.1.1, =1.0.0, =0.4.1, =0.0.1a22, =0.1.1, =0.3.7 and more Source cves...

bert-summarizer (0.0.6) potentially affected by CVE-2026-4372 via transformers (4.0.0rc1)

transformers PYPI version 4.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - bert-summarizer 0.0.6 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

adapters (1.1.1), aibrix (>=0.3.0rc1, <=0.5.0rc1) +57 more potentially affected by CVE-2026-4372 via transformers (4.48.3)

transformers PYPI version 4.48.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adapters 1.1.1 - aibrix =0.3.0rc1, =0.1.0.dev1, =0.2.0, =0.1.0, =0.1.0, =0.1.3, =0.1.3, =0.0.1a0, =0.1.5, =1.0.0, =1.1.4 and more Sourc...

aisak (>=2.2.2, <=2.3.1), astaligner (1.0.2) +13 more potentially affected by CVE-2026-4372 via transformers (4.45.1)

transformers PYPI version 4.45.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aisak =2.2.2, =0.0.1, =1.0.0, =0.1.42.dev0, =0.1.4, =0.0.1a8, =1.0.0a43, =0.2.0, =0.0.8, =0.1.1, =0.3.8, =0.1.0, =0.1.4 Source cves:...

autotrain-advanced (>=0.8.9, <=0.8.11), dgenerate (>=4.2.0, <=4.2.3) +11 more potentially affected by CVE-2026-4372 via transformers (4.44.0)

transformers PYPI version 4.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.8.9, =4.2.0, =0.1.1, =1.0.0, =0.1.0, =0.1.4, =0.3.8, =0.4.0, =0.1.1, =1.0.0, =0.1.0, =0.1.1, =0.1.7 Source cves:...

appcategorizer (>=0.1.0, <=0.2.2), bicleaner-ai (>=3.3.1, <=3.4.0) +38 more potentially affected by CVE-2026-4372 via transformers (4.52.4)

transformers PYPI version 4.52.4 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - appcategorizer =0.1.0, =3.3.1, =0.1.1, =0.5.7, =0.2.13, =3.0.0, =3.0.0rc1, =0.4.0, =0.1.1, =1.1.0, =0.0.3, =0.0.6 and more Source cves:...

any4any (0.1.1), bertnado (>=0.1.0, <=0.1.6) +6 more potentially affected by CVE-2026-4372 via transformers (4.51.0)

transformers PYPI version 4.51.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - any4any 0.1.1 - bertnado =0.1.0, =0.0.0, =0.4.11, =0.1.0, =0.1.1 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

academic-emotion (0.1.2), aqlm (>=1.0.0, <=1.0.1) +10 more potentially affected by CVE-2026-4372 via transformers (4.37.0)

transformers PYPI version 4.37.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - academic-emotion 0.1.2 - aqlm =1.0.0, =0.6.81, =1.1.0, =3.6.1, =0.1.1, =0.1.3, =0.0.4, =0.2.1, =0.10.0, =0.18.2 Source cves:...