@briefhq/cli (>=0.1.6, <=0.1.11), @cobuild/review-gpt (>=0.5.10, <=0.5.96) +3 more potentially affected by CVE-2026-49988 via repomix (>=1.1.0, <=1.14.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =1.0.0, =0.63.0, =0.63.3 Source cves: CVE-2026-49988 Source advisory: SNYK:JS-REPOMIX-17817051...

@briefhq/cli (>=0.1.6, <=0.1.11), @cobuild/review-gpt (>=0.5.10, <=0.5.96) +3 more potentially affected by CVE-2026-49987 via repomix (>=1.1.0, <=1.14.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =1.0.0, =0.63.0, =0.63.3 Source cves: CVE-2026-49987 Source advisory: OSV:GHSA-9MM9-RQHJ-J5MX...

@briefhq/cli (>=0.1.6, <=0.1.11), @cobuild/review-gpt (>=0.5.10, <=0.5.96) +3 more potentially affected by CVE-2026-49987 via repomix (>=1.1.0, <=1.14.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =1.0.0, =0.63.0, =0.63.3 Source cves: CVE-2026-49987 Source advisory: SNYK:JS-REPOMIX-17817038...

guacamol (0.5.3) potentially affected by CVE-2026-12480 via keras (2.1.0)

keras PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - guacamol 0.5.3 Source cves: CVE-2026-12480 Source advisory: OSV:GHSA-26C4-7VV6-867J...

deeppavlov (>=0.0.6b0, <=0.4.0) potentially affected by CVE-2026-12480 via keras (2.2.0)

keras PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - deeppavlov =0.0.6b0, =0.4.0 Source cves: CVE-2026-12480 Source advisory: OSV:GHSA-26C4-7VV6-867J...

adpred (1.3.2), africanwhisper (>=0.2.3, <=0.9.0) +83 more potentially affected by CVE-2026-12480 via keras (>=3.0.0, <=3.12.1)

keras PYPI version =3.0.0, =0.2.3, =0.1.2, =0.1.0, =1.3.0.dev4, =1.1.8, =1.3.3, =0.1.1, =0.1.0, =0.2.3 and more Source cves: CVE-2026-12480 Source advisory: GHSA-26C4-7VV6-867J...

a62-emotion (>=0.10.11, <=0.11.4), adcl (>=0.1.2, <=0.1.4) +160 more potentially affected by CVE-2026-12480 via keras (2.11.0)

keras PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - a62-emotion =0.10.11, =0.1.2, =1.3.0, =1.2.36, =1.0.3, =0.3.1, =0.0.3, =0.2.4, =2.0.0, =0.1.10, =0.0.0, =0.3.1 - brainglobe-workflows 1.0.0 and more...

adpred (>=1.2.8, <=1.2.9), ax-env (>=0.2.2, <=0.2.4) +24 more potentially affected by CVE-2026-12480 via keras (2.8.0)

keras PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - adpred =1.2.8, =0.2.2, =0.1.14, =1.1.9, =1.0.0, =1.1.1 - keras-flower 0.3.0 - napari-deepfinder 0.0.1 and more Source cves: CVE-2026-12480 Source...

aggmap (>=1.1.1, <=1.2.1), ai-music-remixer (3.0.0) +112 more potentially affected by CVE-2026-12480 via keras (2.10.0rc1)

keras PYPI version 2.10.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - aggmap =1.1.1, =0.0.157, =0.1.18, =0.1.11, =0.30.0, =0.0.13, =0.1.0, =0.1.1, =0.1.9 - automea 0.0.13 - avici 1.0.5 - basic-pitch 0.2.3 and more...

bcforms (>=0.0.2, <=0.0.8), bpforms (>=0.0.12, <=0.0.15) +1 more potentially affected by CVE-2022-46291 via openbabel (2.4.1)

openbabel PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on openbabel and may be impacted: - bcforms =0.0.2, =0.0.12, =0.1.0, =0.6.1 Source cves: CVE-2022-46291 Source advisory: OSV:GHSA-JG3H-PV7C-4F9C...

pycham (>=2.1.3, <=2.1.7) potentially affected by CVE-2022-46290 via openbabel (2.4.0)

openbabel PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on openbabel and may be impacted: - pycham =2.1.3, =2.1.7 Source cves: CVE-2022-46290 Source advisory: OSV:GHSA-5RFF-8F7C-8JMW...

bcforms (>=0.0.2, <=0.0.8), bpforms (>=0.0.12, <=0.0.15) +1 more potentially affected by CVE-2022-46290 via openbabel (2.4.1)

openbabel PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on openbabel and may be impacted: - bcforms =0.0.2, =0.0.12, =0.1.0, =0.6.1 Source cves: CVE-2022-46290 Source advisory: OSV:GHSA-5RFF-8F7C-8JMW...

pycham (>=2.1.3, <=2.1.7) potentially affected by CVE-2022-43607 via openbabel (2.4.0)

openbabel PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on openbabel and may be impacted: - pycham =2.1.3, =2.1.7 Source cves: CVE-2022-43607 Source advisory: OSV:GHSA-VJG6-GM8M-V5G6...

pycham (>=2.1.3, <=2.1.7) potentially affected by CVE-2022-43467 via openbabel (2.4.0)

openbabel PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on openbabel and may be impacted: - pycham =2.1.3, =2.1.7 Source cves: CVE-2022-43467 Source advisory: OSV:GHSA-F29H-2H58-48R7...

flambe (>=0.4.11, <=0.4.13) potentially affected by CVE-2026-57516 via ray (0.7.6)

ray PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - flambe =0.4.11, =0.4.13 Source cves: CVE-2026-57516 Source advisory: OSV:PYSEC-2026-2273...

aisfx (0.0.0) potentially affected by CVE-2026-57516 via ray (1.7.0)

ray PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - aisfx 0.0.0 Source cves: CVE-2026-57516 Source advisory: OSV:PYSEC-2026-2273...

ai.acolite:openai-agent-sdk (>=0.1.0, <=0.4.0), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +16632 more potentially affected by CVE-2026-54399 via org.apache.httpcomponents.core5:httpcore5 (>=5.0-alpha1, <=5.4.2)

org.apache.httpcomponents.core5:httpcore5 MAVEN version =5.0-alpha1, =0.1.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.4, =1.0.0, =3.0.0 and more Sour...

@arenahito/droid-webscr (>=0.2.1, <=0.6.1), @cappa/cli (>=0.4.4, <=0.10.4) +2 more potentially affected by CVE-2026-14181 via @fastify/middie (>=9.1.0, <=9.3.2)

@fastify/middie NPM version =9.1.0, =0.2.1, =0.4.4, =0.2.8, =1.0.0-alpha.23, =1.0.0-alpha.28 Source cves: CVE-2026-14181 Source advisory: SNYK:JS-FASTIFYMIDDIE-17753355...

@arenahito/droid-webscr (>=0.2.1, <=0.6.1), @cappa/cli (>=0.4.4, <=0.10.4) +2 more potentially affected by CVE-2026-14198 via @fastify/middie (>=9.1.0, <=9.3.2)

@fastify/middie NPM version =9.1.0, =0.2.1, =0.4.4, =0.2.8, =1.0.0-alpha.23, =1.0.0-alpha.28 Source cves: CVE-2026-14198 Source advisory: SNYK:JS-FASTIFYMIDDIE-17753414...

adi (>=0.7.0, <=0.13.0-pre2), adi_gpu (>=0.7.0, <=0.11.0) +406 more potentially affected by unknown CVE via cgmath (>=0.1.5, <=0.18.0)

cgmath CARGO version =0.1.5, =0.7.0, =0.7.0, =0.8.0, =0.6.0, =0.5.3, =0.8.0, =0.1.0, =0.4.0, =0.2.0, =0.4.0, =0.5.0, =0.5.2, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0196...