dagster-snowflake (>=0.21.8, <=0.22.3), dagster-snowflake-pandas (>=0.21.8, <=0.22.3) +2 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.4.1)

snowflake-connector-python PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dagster-snowflake =0.21.8, =0.21.8, =0.21.8, =0.22.3 - quacker 0.6.2 Source cves: CVE-2026-86597 Source...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in PySpark (CVE-2025-55039)

Summary A deserialization vulnerability in the PySpark component CVE-2025-55039 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.5.8. Vulnerability Details CVEID:CVE-2025-55039 DESCRIPTION: This issue affects Apache Spark versions before 3.4.4...

abi-ds-utils (>=0.1.2, <=1.2.3), abi-pyspark-utils (>=0.1.1, <=0.1.4) +279 more potentially affected by CVE-2026-32773 via pyspark (>=3.0.0, <=3.5.7)

pyspark PYPI version =3.0.0, =0.1.2, =0.1.1, =0.1.5, =0.0.1, =1.7.0.dev1715243393, =1.7.0.dev1715243330, =1.7.0.dev1715246251, =1.7.0.dev1715246284, =1.0.6, =0.0.12, =0.0.1, =0.0.7, =0.0.31 and more Source cves: CVE-2026-32773 Source advisory: OSV:GHSA-9437-39HJ-3C93...

abi-ds-utils (>=0.1.2, <=1.2.3), abi-pyspark-utils (>=0.1.1, <=0.1.4) +279 more potentially affected by CVE-2026-32773 via pyspark (>=3.0.0, <=3.5.7)

pyspark PYPI version =3.0.0, =0.1.2, =0.1.1, =0.1.5, =0.0.1, =1.7.0.dev1715243393, =1.7.0.dev1715243330, =1.7.0.dev1715246251, =1.7.0.dev1715246284, =1.0.6, =0.0.12, =0.0.1, =0.0.7, =0.0.31 and more Source cves: CVE-2026-32773 Source advisory: GHSA-9437-39HJ-3C93...

abi-ds-utils (>=0.1.2, <=1.2.3), abi-pyspark-utils (>=0.1.1, <=0.1.4) +279 more potentially affected by CVE-2026-32773 via pyspark (>=3.0.0, <=3.5.7)

pyspark PYPI version =3.0.0, =0.1.2, =0.1.1, =0.1.5, =0.0.1, =1.7.0.dev1715243393, =1.7.0.dev1715243330, =1.7.0.dev1715246251, =1.7.0.dev1715246284, =1.0.6, =0.0.12, =0.0.1, =0.0.7, =0.0.31 and more Source cves: CVE-2026-32773 Source advisory: OSV:PYSEC-2026-3966...

abi-ds-utils (>=0.1.2, <=1.2.3), abi-pyspark-utils (>=0.1.1, <=0.1.4) +279 more potentially affected by CVE-2026-32773 via pyspark (>=3.0.0, <=3.5.7)

pyspark PYPI version =3.0.0, =0.1.2, =0.1.1, =0.1.5, =0.0.1, =1.7.0.dev1715243393, =1.7.0.dev1715243330, =1.7.0.dev1715246251, =1.7.0.dev1715246284, =1.0.6, =0.0.12, =0.0.1, =0.0.7, =0.0.31 and more Source cves: CVE-2026-32773 Source advisory: MEND:CVE-2026-32773...

dagster-gcp-pandas (>=0.17.20, <=0.29.0), dagster-gcp-pyspark (>=0.17.21, <=0.29.0) potentially affected by CVE-2026-41490 via dagster-gcp (>=0.17.20, <=0.29.0)

dagster-gcp PYPI version =0.17.20, =0.17.20, =0.17.21, =0.29.0 Source cves: CVE-2026-41490 Source advisory: OSV:PYSEC-2026-2435...

dagster-snowflake-pandas (>=0.14.15, <=0.29.0), dagster-snowflake-polars (>=0.27.2, <=0.29.0) +2 more potentially affected by CVE-2026-41490 via dagster-snowflake (>=0.14.15, <=0.29.0)

dagster-snowflake PYPI version =0.14.15, =0.14.15, =0.27.2, =0.17.15, =1.0.0, =1.1.2 Source cves: CVE-2026-41490 Source advisory: OSV:PYSEC-2026-2436...

clarifai (>=9.9.3, <=9.10.4), clarifai-pyspark (>=0.0.1, <=0.0.3) +8 more potentially affected by CVE-2025-71176 via pytest (7.4.1)

pytest PYPI version 7.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - clarifai =9.9.3, =0.0.1, =0.0.1, =0.0.1, =1.0.1, =1.0.7 - webtorchx 0.0.1 Source cves: CVE-2025-71176 Source advisory: OSV:PYSEC-2026-1845...

pyspark-ai (>=0.1.0, <=0.1.12), spark-llm (>=0.1.4, <=0.1.9) potentially affected by CVE-2026-55443 via langchain (0.0.201)

langchain PYPI version 0.0.201 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - pyspark-ai =0.1.0, =0.1.4, =0.1.9 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

pyspark-ai (>=0.1.0, <=0.1.12), spark-llm (>=0.1.4, <=0.1.9) potentially affected by CVE-2026-55443 via langchain (0.0.201)

langchain PYPI version 0.0.201 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - pyspark-ai =0.1.0, =0.1.4, =0.1.9 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

ROOT-APP-PYPI-CVE-2023-22946 CVE-2023-22946 in pyspark - Patched by Root

Root has patched CVE-2023-22946 in the pyspark package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2022-31777 CVE-2022-31777 in pyspark - Patched by Root

Root has patched CVE-2022-31777 in the pyspark package for Root:PyPI. Multiple fixed versions available...

ANT-2026-PGRNAV88 · Spark · other

other critical Severity Claude critical · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-PGRNAV88: spark rce UserDefinedType.fromJson in python/pyspark/sql/types.py:2002 passes bytes taken from...

abi-ds-utils (>=0.1.2, <=0.1.9), abi-pyspark-utils (>=0.1.1, <=0.1.4) +62 more potentially affected by unknown CVE via pyspark (>=3.0.3, <=3.1.3)

pyspark PYPI version =3.0.3, =0.1.2, =0.1.1, =0.1.5, =0.5.1, =1.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.0, =1.0.1 - cehrbert 1.5.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2018-0629...

chronon-ai (>=0.0.110, <=0.0.115), cuallee (>=0.0.2, <=0.1.1) +39 more potentially affected by unknown CVE via pyspark (>=3.3.0, <=3.3.1)

pyspark PYPI version =3.3.0, =0.0.110, =0.0.2, =0.0.1, =1.107.2rc3, =1.0.12.1, =1.0.15.1, =0.0.2.3, =0.0.0, =0.3.1, =4.0.0, =1.8.0, =0.3.3, =3.0.0, =0.2.0.dev0, =0.2.0.dev1 and more Source cves: unknown CVE Source advisory: MEND:WS-2022-0468...

bigdl-dllib-spark3 (>=2.5.0b20240301, <=2.5.0b20240324), bigdl-friesian-spark3 (>=2.5.0b20240301, <=2.5.0b20240324) +30 more potentially affected by unknown CVE via pyspark (>=3.4.1, <=3.4.4)

pyspark PYPI version =3.4.1, =2.5.0b20240301, =2.5.0b20240301, =2.5.0b20240301, =2.5.0b20240301, =0.6.2, =0.4.0, =3.2.0b1, =2.4.0, =0.1.0, =0.6.0, =0.2.0, =1.17.0, =6.4.0.dev0, =6.6.0.dev0 and more Source cves: unknown CVE Source advisory: MEND:WS-2022-0468...

aicns-univariate-analyzer (>=0.0.1, <=0.5.0), anomalywatchdog (>=0.0.2, <=0.0.7) +32 more potentially affected by unknown CVE via pyspark (>=3.2.0, <=3.2.2)

pyspark PYPI version =3.2.0, =0.0.1, =0.0.2, =0.2.1, =1.0.1, =1.0.1, =0.0.6, =0.2.0.dev2, =0.2.0.dev0, =0.2.0.dev2, =0.2.0.dev0, =0.2.0.dev2, =0.3.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2021-0616...

chronon-ai (>=0.0.110, <=0.0.115), cuallee (>=0.0.2, <=0.1.1) +39 more potentially affected by unknown CVE via pyspark (>=3.3.0, <=3.3.1)

pyspark PYPI version =3.3.0, =0.0.110, =0.0.2, =0.0.1, =1.107.2rc3, =1.0.12.1, =1.0.15.1, =0.0.2.3, =0.0.0, =0.3.1, =4.0.0, =1.8.0, =0.3.3, =3.0.0, =0.2.0.dev0, =0.2.0.dev1 and more Source cves: unknown CVE Source advisory: MEND:WS-2021-0419...

aissemble-extensions-data-delivery-spark-py (>=1.11.1, <=1.12.1), aissemble-extensions-transform-spark-python (>=1.11.1, <=1.12.1) +27 more potentially affected by unknown CVE via pyspark (>=3.5.3, <=3.5.4)

pyspark PYPI version =3.5.3, =1.11.1, =1.11.1, =1.11.1, =1.11.1, =0.0.32, =2.2.7, =1.2.0a0, =0.1.0, =1.0.1, =1.0.5, =0.3.8, =0.4.11 and more Source cves: unknown CVE Source advisory: MEND:WS-2021-0419...