Open Security Benchmark: Towards Autonomous Enterprise Cyber Defense

Enterprises are moving toward autonomous cyber defense: agentic AI that builds situational awareness of an organization's security state and reasons from it to assessments, decisions, and actions. This rests on a holistic view of the enterprise's security state, the continuous, cross-vendor pictu...

CVE-2026-65010

A flaw was found in Hugging Face Datasets through 5.00 in Extractor.extract. When archive contents are extracted to predictable output paths, the extractor follows pre-planted symlinks instead of confining writes to the intended directory. A local attacker who can place those symlinks can redirec...

aa-rag (>=0.4.2, <=0.4.3), aaa-ml-datasets-course (1.0.0) +799 more potentially affected by CVE-2025-71408 via nltk (>=2.0.4, <=3.9.2)

nltk PYPI version =2.0.4, =0.4.2, =0.2.3, =0.2.0, =0.0.4, =0.0.1, =0.1.0, =0.1.0, =0.0.9, =0.17.0, =0.0.0.dev0, =7.28.2.post5.dev33128883500 and more Source cves: CVE-2025-71408 Source advisory: MEND:CVE-2025-71408...

GHSA-379C-QX7V-6H59 Hugging Face Datasets folder-based builders allow path traversal through file_name metadata

Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the filename metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted filename values with directory traversal...

jiant (>=2.1.0, <=2.2.0) potentially affected by CVE-2026-66007 via datasets (1.1.2)

datasets PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - jiant =2.1.0, =2.2.0 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

transformer-vae (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-66007 via datasets (1.1.3)

datasets PYPI version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - transformer-vae =0.0.1, =0.0.2 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

biome-text (3.0.0), gradsflow (>=0.0.1b1, <=0.0.3) +6 more potentially affected by CVE-2026-66007 via datasets (1.2.1)

datasets PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - biome-text 3.0.0 - gradsflow =0.0.1b1, =0.1.0, =0.2.13, =0.3.0a1, =0.3.1 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

medcat (>=1.0.0.dev32, <=1.0.0.dev45) potentially affected by CVE-2026-66007 via datasets (1.3.0)

datasets PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - medcat =1.0.0.dev32, =1.0.0.dev45 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

indobenchmark-toolkit (>=0.0.1, <=0.0.5) potentially affected by CVE-2026-66007 via datasets (1.4.1)

datasets PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - indobenchmark-toolkit =0.0.1, =0.0.5 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

ctc-score (>=0.1.0a1, <=0.1.0a3), formerbox (>=0.3.0b1, <=0.3.0b2) +4 more potentially affected by CVE-2026-66007 via datasets (1.5.0)

datasets PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - ctc-score =0.1.0a1, =0.3.0b1, =1.0.0.dev46, =0.15.4rc0, =0.0.4, =0.0.7 - sonorus 0.1.1 Source cves: CVE-2026-66007 Source advisory:...

clarinpl-embeddings (>=0.0.1rc19, <=0.0.1rc158803945536), sri-d3m (1.10.0) potentially affected by CVE-2026-66007 via datasets (1.6.1)

datasets PYPI version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - clarinpl-embeddings =0.0.1rc19, =0.0.1rc158803945536 - sri-d3m 1.10.0 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

medcat (>=1.0.25, <=1.1.3), medflux (>=0.0.1, <=0.1.2) +2 more potentially affected by CVE-2026-66007 via datasets (1.6.2)

datasets PYPI version 1.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - medcat =1.0.25, =0.0.1, =0.2.0, =0.1.0, =0.1.5 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

esntorch (>=0.0.2, <=1.0.6), model-hub (>=0.16.0rc0, <=0.16.5) +1 more potentially affected by CVE-2026-66007 via datasets (1.7.0)

datasets PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - esntorch =0.0.2, =0.16.0rc0, =0.0.1, =0.0.3 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

adaptnlp (>=0.3.0, <=0.3.5), autonlp (>=0.2.8, <=0.3.2) +3 more potentially affected by CVE-2026-66007 via datasets (1.8.0)

datasets PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - adaptnlp =0.3.0, =0.2.8, =1.37.0, =3.1.0, =0.1.1, =0.1.7 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

autonlp (>=0.3.3, <=0.3.4), repro (>=0.0.1, <=0.1.3) +2 more potentially affected by CVE-2026-66007 via datasets (1.9.0)

datasets PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - autonlp =0.3.3, =0.0.1, =0.2.4, =1.0.2, =1.0.4 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

api-inference-community (>=0.0.12, <=0.0.22), bent (>=0.0.9, <=0.0.27) potentially affected by CVE-2026-66007 via datasets (1.10.0)

datasets PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - api-inference-community =0.0.12, =0.0.9, =0.0.27 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

t5s (>=0.1.0, <=2.0.8) potentially affected by CVE-2026-66007 via datasets (1.10.2)

datasets PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - t5s =0.1.0, =2.0.8 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

autonlp (>=0.3.5, <=0.3.7), autotrain-advanced (0.4.0) +12 more potentially affected by CVE-2026-66007 via datasets (1.11.0)

datasets PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - autonlp =0.3.5, =1.45.0, =0.0.1, =0.2.2, =0.0.2, =0.1.7, =2.0.0, =1.4.0, =0.1.3, =0.2.12, =0.2.14 Source cves: CVE-2026-66007 Source advisory:...

classy-core (>=0.1.0.dev20211019, <=0.2.1), gperc (>=0.6.0, <=0.7.0) +3 more potentially affected by CVE-2026-66007 via datasets (1.12.1)

datasets PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - classy-core =0.1.0.dev20211019, =0.6.0, =0.2.2, =0.1.3, =0.1.8 - paoding 0.1.1 Source cves: CVE-2026-66007 Source advisory:...

chatting-chatbots (0.0.1), embedding-lenses (>=0.1.0, <=0.11.0) +3 more potentially affected by CVE-2026-66007 via datasets (1.14.0)

datasets PYPI version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - chatting-chatbots 0.0.1 - embedding-lenses =0.1.0, =1.2.0, =0.3.0, =0.3.3 - zensols-mednlp 0.0.1 Source cves: CVE-2026-66007 Source advisory:...