bluecore-models (>=0.11.1, <=0.25.0), orilinx (1.0.1) potentially affected by CVE-2026-9856 via transformers (4.57.5)

transformers PYPI version 4.57.5 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - bluecore-models =0.11.1, =0.25.0 - orilinx 1.0.1 Source cves: CVE-2026-9856 Source advisory: OSV:GHSA-XRQW-3RRV-VX5W...

airunner (>=3.1.8, <=3.1.14), ano-code (>=1.1.39, <=8.0.34) +19 more potentially affected by CVE-2026-9856 via transformers (4.48.1)

transformers PYPI version 4.48.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - airunner =3.1.8, =1.1.39, =3.1.6, =0.0.1, =1.0.0, =0.1.0, =2.6.0rc1, =0.1.0, =2025.2.0, =2025.2.0, =2025.2.0, =2025.2.0, =2025.3.2 -...

auto-deep-learning (>=0.1.5.1, <=0.1.5.4), autogluon-multimodal (>=0.6.3b20230121, <=0.6.3b20230203) +50 more potentially affected by CVE-2026-9856 via transformers (4.25.1)

transformers PYPI version 4.25.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - auto-deep-learning =0.1.5.1, =0.6.3b20230121, =0.0.1, =0.0.1, =2.3.0, =0.1.3, =0.0.1rc5, =0.0.7, =0.0.1, =1.12.0rc1, =0.12.0, =0.12.1 -...

abgpt (>=0.1.1, <=0.1.2), adaptive-reranker (>=0.1.0, <=0.1.1) +81 more potentially affected by CVE-2026-9856 via transformers (4.44.2)

transformers PYPI version 4.44.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - abgpt =0.1.1, =0.1.0, =0.1.0, =0.8.16, =0.0.2, =0.5.4, =0.3.3, =2.6.0b1, =0.1.2, =0.1.16, =0.0.1.dev1, =0.0.2, =0.0.6 - craftext 0.2.2...

allennlp (>=2.9.0.dev20211224, <=2.9.0), bcipy (>=2.0.0rc1, <=2.0.1rc2) +13 more potentially affected by CVE-2026-9856 via transformers (4.15.0)

transformers PYPI version 4.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.9.0.dev20211224, =2.0.0rc1, =0.0.6, =1.0.6, =0.1.0, =1.2.0, =0.0.1, =0.0.2 - wandb-allennlp 0.3.1 Source cves: CVE-2026-985...

alignment-handbook (0.1.0), geniebottle (0.0.3) +7 more potentially affected by CVE-2026-9856 via transformers (4.37.1)

transformers PYPI version 4.37.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - alignment-handbook 0.1.0 - geniebottle 0.0.3 - llm-docstring-generator 1.0.0 - lmdeploy =0.2.3, =0.0.2, =0.0.6, =0.0.7 - video2dataset...

adapters (1.1.1), aibrix (>=0.3.0rc1, <=0.5.0rc1) +56 more potentially affected by CVE-2026-9856 via transformers (4.48.3)

transformers PYPI version 4.48.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adapters 1.1.1 - aibrix =0.3.0rc1, =0.1.0.dev1, =0.2.0, =0.1.0, =0.1.0, =0.1.3, =0.1.3, =0.0.1a0, =0.1.5, =1.0.0, =1.1.4 -...

arelight (0.24.0), bicleaner-ai (2.0.0rc2) +25 more potentially affected by CVE-2026-9856 via transformers (4.24.0)

transformers PYPI version 4.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - arelight 0.24.0 - bicleaner-ai 2.0.0rc2 - bnaug =1.0.0.dev0, =2.0.4, =0.0.0, =0.8.7a0, =1.0.0, =0.0.3, =0.0.1, =1.1.25, =1.2.28 and mor...

frony-document-processor (0.3.0), vllm-plugin-meralion2 (>=0.1.2.post2.dev1, <=0.1.2.post2) +1 more potentially affected by CVE-2026-9856 via transformers (4.50.1)

transformers PYPI version 4.50.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - frony-document-processor 0.3.0 - vllm-plugin-meralion2 =0.1.2.post2.dev1, =1.0.0rc1, =1.0.0rc2 Source cves: CVE-2026-9856 Source...

a62-emotion (>=0.10.11, <=0.11.4), aac-metrics (>=0.5.5, <=0.6.0) +1917 more potentially affected by CVE-2026-9856 via transformers (4.57.6)

transformers PYPI version 4.57.6 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - a62-emotion =0.10.11, =0.5.5, =0.2.1, =0.1.0, =1.3.8, =20260210.0.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-9856 Source...

arctic-training (>=0.0.1, <=0.0.2), bcipy (2.0.1) +13 more potentially affected by CVE-2026-9856 via transformers (4.47.0)

transformers PYPI version 4.47.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - arctic-training =0.0.1, =0.0.32, =0.3.8.0, =0.1.0, =0.1.3, =0.2.0, =0.1.0, =1.0.0, =0.1.0, =0.1.1 Source cves: CVE-2026-9856 Source...

aait (0.0.4.80), adore (>=0.0.1, <=0.1.2) +111 more potentially affected by CVE-2026-9856 via transformers (4.46.3)

transformers PYPI version 4.46.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aait 0.0.4.80 - adore =0.0.1, =5.0.0, =5.0.0, =0.1.8, =0.1.3, =26.5.1, =0.1.0, =0.1.0, =0.1.6 - chatterbox-tts-api 1.0.0 and more Sourc...

hearbaseline (>=2021.0.3, <=2021.0.5), pydebiaseddta (0.1.0) +2 more potentially affected by CVE-2026-9856 via transformers (4.4.0)

transformers PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - hearbaseline =2021.0.3, =1.0.0a0, =0.6.20, =0.7.18 Source cves: CVE-2026-9856 Source advisory: OSV:GHSA-XRQW-3RRV-VX5W...

africanwhisper (>=0.2.3, <=0.9.0), batched-melbo (0.1.0) +8 more potentially affected by CVE-2026-9856 via transformers (4.39.2)

transformers PYPI version 4.39.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - africanwhisper =0.2.3, =0.0.1a1, =0.1.1, =0.2.0, =0.0.2, =0.0.1, =0.2.1, =0.2.3, =0.2.3.post1 - rgpl 0.1.0 Source cves: CVE-2026-9856...

avalan (>=1.2.0, <=1.2.13), mcp-instana (0.1.1) +4 more potentially affected by CVE-2026-9856 via transformers (4.53.1)

transformers PYPI version 4.53.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - avalan =1.2.0, =0.8.6, =0.9.2a0, =0.9.1a0, =0.9.2 Source cves: CVE-2026-9856 Source advisory: OSV:GHSA-XRQW-3RRV-VX5W...

agentkb (>=0.1.0, <=0.3.0), aicaller (>=1.1.8, <=1.1.11) +224 more potentially affected by CVE-2026-9856 via transformers (>=5.0.0rc0, <=5.9.0)

transformers PYPI version =5.0.0rc0, =0.1.0, =1.1.8, =0.1.0, =1.1.0, =2026.5.22, =0.7.0, =2.0.0, =3.1.0, =3.9.11, =0.2.2, =0.14.0, =0.17.0 and more Source cves: CVE-2026-9856 Source advisory: OSV:GHSA-XRQW-3RRV-VX5W...

baram (>=0.3.2, <=0.3.7), basejump (>=0.1.7, <=0.3.1) +16 more potentially affected by CVE-2026-65321 via pyathena (>=3.0.5, <=3.34.0)

pyathena PYPI version =3.0.5, =0.3.2, =0.1.7, =0.31.6, =1.1.150, =3.0.0, =6.0.5, =0.1.2, =9.0.0, =0.2.0, =1.0.0, =0.4.0, =1.0.0, =0.1.0, =1.11.0, =1.11.0, =1.11.1 and more Source cves: CVE-2026-65321 Source advisory: SNYK:PYTHON-PYATHENA-19270043...

Malicious code in trongriden (PyPI)

Source: kam193 dfb2a16e0023940b622e66acf21c1597d4127d94fb730610f509960e49754c3f Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some packages additionally clone the readme of other, legit...

3m (0.1.0), a62-emotion (>=0.10.11, <=0.11.4) +3926 more potentially affected by CVE-2026-9856 via transformers (>=0.1.0, <=5.9.0)

transformers PYPI version =0.1.0, =0.10.11, =0.5.5, =0.0.4.80, =0.2.1, =0.1.0, =0.1.1, =1.3.8, =1.5.3 - acace-coherence-checker 0.1.0 - acace-compression-engine 0.1.0 - acace-semantic-analyzer 0.1.0 - acace-sentiment-analyzer 0.1.0 - acace-topic-extractor 0.1.0 - academic-emotion 0.1.2 and more...

adpred (1.3.2), africanwhisper (>=0.2.3, <=0.9.0) +83 more potentially affected by CVE-2026-9335 via keras (>=3.0.0, <=3.12.1)

keras PYPI version =3.0.0, =0.2.3, =0.1.2, =0.1.0, =1.3.0.dev4, =1.1.8, =1.3.3, =0.1.1, =0.1.0, =0.2.3 and more Source cves: CVE-2026-9335 Source advisory: SNYK:PYTHON-KERAS-18507704...