autogpt-forge (>=0.1.0, <=0.1.3), cosmoai (>=0.6.0, <=0.6.6) +12 more potentially affected by CVE-2024-2952 via litellm (0.1.7713)

litellm PYPI version 0.1.7713 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - autogpt-forge =0.1.0, =0.6.0, =0.2.4, =0.1.11, =0.0.1, =0.1.7, =0.1.0, =0.1.2, =0.0.2, =0.0.3 - yival 0.1.0a4 Source cves: CVE-2024-2952 Source...

openlayer (0.0.0a0), sentencebertservice (20211205152102.0.0) +1 more potentially affected by CVE-2024-2912 via bentoml (0.13.1)

bentoml PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - openlayer 0.0.0a0 - sentencebertservice 20211205152102.0.0 - unboxapi =0.1.1, =0.3.0 Source cves: CVE-2024-2912 Source advisory: OSV:PYSEC-2026-2...

nl2ltl (>=0.0.1, <=0.0.4), pyspace-toolkit (>=1.0.2, <=1.0.3) +2 more potentially affected by CVE-2024-49375 via rasa (>=3.4.0, <=3.6.20)

rasa PYPI version =3.4.0, =0.0.1, =1.0.2, =0.2.0, =0.1.0, =0.1.1 Source cves: CVE-2024-49375 Source advisory: OSV:PYSEC-2026-513...

curation-utils (0.1.4) potentially affected by CVE-2025-58438 via internetarchive (1.9.9)

internetarchive PYPI version 1.9.9 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - curation-utils 0.1.4 Source cves: CVE-2025-58438 Source advisory: OSV:PYSEC-2026-357...

mlsquare (0.2.1) potentially affected by CVE-2025-62593 via ray (0.6.5)

ray PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - mlsquare 0.2.1 Source cves: CVE-2025-62593 Source advisory: OSV:PYSEC-2026-520...

biome-text (3.3.0), discern-reconstruction (>=0.1.0, <=0.1.1) +5 more potentially affected by CVE-2025-34351 via ray (1.6.0)

ray PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - biome-text 3.3.0 - discern-reconstruction =0.1.0, =0.1.7, =0.0.3.dev0, =0.2.4, =1.3.0, =2.2.10 - raylab 0.16.1 Source cves: CVE-2025-34351 Source advisory...

ambientagi (>=0.1.1, <=0.2.12), kolega-code (>=0.1.0, <=0.3.0) +7 more potentially affected by CVE-2025-47241 via browser-use (>=0.1.19, <=0.1.41)

browser-use PYPI version =0.1.19, =0.1.1, =0.1.0, =0.1.0, =0.1.15, =0.1.1, =0.1.1, =2.1.1, =0.1.0, =0.13.0, =0.14.1 Source cves: CVE-2025-47241 Source advisory: OSV:PYSEC-2026-300...

modin (>=0.1.0, <=0.1.1) potentially affected by CVE-2025-34351 via ray (0.5.0)

ray PYPI version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - modin =0.1.0, =0.1.1 Source cves: CVE-2025-34351 Source advisory: OSV:PYSEC-2026-518...

deepnlpf (>=0.0.18, <=0.0.20) potentially affected by CVE-2025-62593 via ray (1.11.0)

ray PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - deepnlpf =0.0.18, =0.0.20 Source cves: CVE-2025-62593 Source advisory: OSV:PYSEC-2026-520...

autogluon (>=0.3.2b20220126, <=0.4.1b20220317), gen2-connector (>=1.0.0b48, <=1.0.0b56) +2 more potentially affected by CVE-2025-62593 via ray (1.8.0)

ray PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - autogluon =0.3.2b20220126, =1.0.0b48, =0.0.7.post1, =0.1.0b0, =0.1.3 Source cves: CVE-2025-62593 Source advisory: OSV:PYSEC-2026-520...

flopyarcade (>=0.3.35, <=0.6.3), gen2-connector (1.0.0b61) +1 more potentially affected by CVE-2025-62593 via ray (1.9.2)

ray PYPI version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - flopyarcade =0.3.35, =0.0.7, =0.1.4 Source cves: CVE-2025-62593 Source advisory: OSV:PYSEC-2026-520...

autogluon (>=0.3.2b20211214, <=0.3.2b20220125), msapy (>=0.0.1, <=1.0.0) potentially affected by CVE-2025-34351 via ray (1.7.1)

ray PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - autogluon =0.3.2b20211214, =0.0.1, =1.0.0 Source cves: CVE-2025-34351 Source advisory: OSV:PYSEC-2026-518...

argos-trains (0.1.0), beta-rec (>=0.2.3, <=0.3.2) +3 more potentially affected by CVE-2025-62593 via ray (1.0.1)

ray PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - argos-trains 0.1.0 - beta-rec =0.2.3, =0.1.1, =0.2.1 - raylab 0.14.9 - tamu-axolotl 2021.4.8 Source cves: CVE-2025-62593 Source advisory: OSV:PYSEC-2026-5...

connector-db-tools (0.0.1), pdf2dataset (>=0.1.0, <=0.4.0a1) +1 more potentially affected by CVE-2025-34351 via ray (0.8.6)

ray PYPI version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - connector-db-tools 0.0.1 - pdf2dataset =0.1.0, =0.4.10, =0.4.11 Source cves: CVE-2025-34351 Source advisory: OSV:PYSEC-2026-518...

encdecmeta (0.0.3), nevopy (>=0.0.1, <=0.2.3) potentially affected by CVE-2025-62593 via ray (1.1.0)

ray PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - encdecmeta 0.0.3 - nevopy =0.0.1, =0.2.3 Source cves: CVE-2025-62593 Source advisory: OSV:PYSEC-2026-520...

deephyper (>=0.1.10, <=0.1.11), l2hmc (>=0.1.0, <=0.13.0) +12 more potentially affected by CVE-2024-10190 via horovod (>=0.19.5, <=0.28.1)

horovod PYPI version =0.19.5, =0.1.10, =0.1.0, =0.1.1, =0.0.0a0, =0.0.3, =0.0.1.0, =0.1.0, =0.1.2, =0.1.8 - zetascale 0.7.1 Source cves: CVE-2024-10190 Source advisory: OSV:PYSEC-2026-355...

bespokelabs-curator (>=0.1.15rc1, <=0.1.15.post1), deepseek-coder (>=0.1.0a0, <=0.1.0) +24 more potentially affected by CVE-2025-47277 via vllm (>=0.6.6.post1, <=0.8.4)

vllm PYPI version =0.6.6.post1, =0.1.15rc1, =0.1.0a0, =0.0.2, =0.1.1, =0.1.10, =0.0.2, =0.1.1, =0.2.0, =2.0.0a2, =0.0.15, =0.0.7, =0.1.0, =0.3.0 and more Source cves: CVE-2025-47277 Source advisory: OSV:PYSEC-2026-567...

autogluon (>=0.4.1b20220511, <=0.5.3b20221005), autogluon-multimodal (>=0.4.3b20220616, <=0.5.3b20221005) +38 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.6.5.post0)

pytorch-lightning PYPI version 1.6.5.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - autogluon =0.4.1b20220511, =0.4.3b20220616, =0.4.1b20220511, =1.0.0, =0.1.3, =0.5.33, =0.1.5, =0.6.0, =0.6.1, =0.47.0,...

paoding (0.1.1), pytorch-segmentation-models-trainer (0.12.0) potentially affected by CVE-2024-8019 via pytorch-lightning (1.4.8)

pytorch-lightning PYPI version 1.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - paoding 0.1.1 - pytorch-segmentation-models-trainer 0.12.0 Source cves: CVE-2024-8019 Source advisory: OSV:PYSEC-2026-507...

asteroid (>=0.5.0rc0, <=0.5.0), backprop (>=0.0.3, <=0.1.3) +12 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.2.10)

pytorch-lightning PYPI version 1.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.5.0rc0, =0.0.3, =0.3.0b1, =1.0.0, =0.3.1.0, =2.0.0, =1.0.4, =0.8.1, =1.0.0, =0.1.0, =0.2.0 Source cves:...