easyvvuq (>=0.5.2.1, <=0.5.2.2), feature-engine (0.3.0) +11 more potentially affected by CVE-2025-71176 via pytest (4.3.1)

pytest PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - easyvvuq =0.5.2.1, =0.0.3, =0.1.3, =0.10.7, =2019.3.12, =0.0.11, =0.1.2, =0.1.0.dev2210, =0.1.1 Source cves: CVE-2025-71176 Source advisory:...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-22690 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2026-22690 Source advisory: OSV:PYSEC-2026-1829...

bokcolmaps (0.3.1), bokodapviewer (0.1.3) +2 more potentially affected by CVE-2026-21883 via bokeh (0.12.6)

bokeh PYPI version 0.12.6 is affected by a known vulnerability. The following packages have a transitive dependency on bokeh and may be impacted: - bokcolmaps 0.3.1 - bokodapviewer 0.1.3 - pandexo-engine =1.5.1, =0.1.0, =0.1.2 Source cves: CVE-2026-21883 Source advisory: OSV:PYSEC-2026-1223...

elemeno-ai-sdk (>=0.0.5, <=0.6.11), elemeno-mlops-cli (>=0.0.1, <=0.0.4) +22 more potentially affected by CVE-2025-11157 via feast (>=0.9.3, <=0.49.0)

feast PYPI version =0.9.3, =0.0.5, =0.0.1, =0.1.0, =0.3.0, =0.1.0rc3, =0.0.2, =1.0.0, =0.1.0, =0.1.33.dev3, =0.1.0, =0.6.19 and more Source cves: CVE-2025-11157 Source advisory: OSV:PYSEC-2026-1366...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2025-66019 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2025-66019 Source advisory: OSV:PYSEC-2026-1832...

vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs

SummaryUsers can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape e.g. hidden dimension is wrong, regardless of whether the model is intended to support such inputs as defined in the Supported Models page.The issue has...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2025-62708 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2025-62708 Source advisory: OSV:PYSEC-2026-1831...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2025-62707 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2025-62707 Source advisory: OSV:PYSEC-2026-1833...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2025-6921 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2025-6921 Source advisory: OSV:PYSEC-2026-1980...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2025-6051 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2025-6051 Source advisory: OSV:PYSEC-2026-1988...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2025-6638 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2025-6638 Source advisory: OSV:PYSEC-2026-1981...

cdisc-rules-engine (>=0.1.0, <=0.4.7.8), systembridgebackend (>=3.4.0.dev2, <=3.4.3) +2 more potentially affected by CVE-2025-59042 via pyinstaller (5.2.0)

pyinstaller PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyinstaller and may be impacted: - cdisc-rules-engine =0.1.0, =3.4.0.dev2, =3.4.0.dev2, =3.4.0.dev2, =3.4.3 Source cves: CVE-2025-59042 Source advisory: OSV:PYSEC-2026-1813...

PYSEC-2026-1815 Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Dear Maintainers, I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation. Summary The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of...

fair-llm (>=0.2.0, <=0.6.2), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2025-55197 via pypdf (5.6.0)

pypdf PYPI version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - fair-llm =0.2.0, =0.0.1b1, =30.0.5, =30.0.7 - textspitter 0.4.0b0 Source cves: CVE-2025-55197 Source advisory: OSV:PYSEC-2026-1830...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2025-5197 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2025-5197 Source advisory: OSV:PYSEC-2026-1983...

dagit (0.10.9), dagster-airflow (0.10.9) +3 more potentially affected by CVE-2023-51232 via dagster (0.10.9)

dagster PYPI version 0.10.9 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.10.9 - dagster-airflow 0.10.9 - spine-engine =0.10.1rc1, =0.11.0 - spine-items 0.8.0 - spinetoolbox 0.6.3 Source cves: CVE-2023-51232...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2025-3933 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2025-3933 Source advisory: OSV:PYSEC-2026-1977...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2025-3264 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2025-3264 Source advisory: OSV:PYSEC-2026-1985...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2025-3263 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2025-3263 Source advisory: OSV:PYSEC-2026-1987...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2025-3777 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2025-3777 Source advisory: OSV:PYSEC-2026-1986...