al-for-design (0.0.1), autogluon (>=0.0.5, <=0.1.0b20210209) +48 more potentially affected by CVE-2026-59199 via pillow (6.2.1)

pillow PYPI version 6.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - al-for-design 0.0.1 - autogluon =0.0.5, =0.0.15b20201014, =0.0.15b20201024, =0.0.16b20210114, =0.0.15b20201024, =0.0.121, =0.0.1, =0.0.1, =0.0.1,...

abraia (>=0.8.10, <=0.9.2), adamapi (>=2.1.0, <=2.2.0) +128 more potentially affected by CVE-2026-55380 via pillow (8.3.2)

pillow PYPI version 8.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - abraia =0.8.10, =2.1.0, =1.1.3, =1.5.0, =0.0.25, =0.2.2, =0.0.2a2, =1.4.0, =0.2.2, =0.0.1, =0.2.1b20210731, =0.2.1b20210731, =0.3.2b20211206 and mor...

abraia (>=0.8.10, <=0.9.2), adamapi (>=2.1.0, <=2.2.0) +128 more potentially affected by CVE-2026-55379 via pillow (8.3.2)

pillow PYPI version 8.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - abraia =0.8.10, =2.1.0, =1.1.3, =1.5.0, =0.0.25, =0.2.2, =0.0.2a2, =1.4.0, =0.2.2, =0.0.1, =0.2.1b20210731, =0.2.1b20210731, =0.3.2b20211206 and mor...

abraia (>=0.8.10, <=0.9.2), adamapi (>=2.1.0, <=2.2.0) +128 more potentially affected by CVE-2026-54059 via pillow (8.3.2)

pillow PYPI version 8.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - abraia =0.8.10, =2.1.0, =1.1.3, =1.5.0, =0.0.25, =0.2.2, =0.0.2a2, =1.4.0, =0.2.2, =0.0.1, =0.2.1b20210731, =0.2.1b20210731, =0.3.2b20211206 and mor...

al-for-design (0.0.1), autogluon (>=0.0.5, <=0.1.0b20210209) +48 more potentially affected by CVE-2026-54059 via pillow (6.2.1)

pillow PYPI version 6.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - al-for-design 0.0.1 - autogluon =0.0.5, =0.0.15b20201014, =0.0.15b20201024, =0.0.16b20210114, =0.0.15b20201024, =0.0.121, =0.0.1, =0.0.1, =0.0.1,...

auto-obsidian (>=0.1.0, <=0.1.3), autogluon (0.5.3) +10 more potentially affected by CVE-2026-5241 via transformers (4.23.1)

transformers PYPI version 4.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - auto-obsidian =0.1.0, =0.5.3b20221025, =0.1.0, =0.0.8, =0.0.14 Source cves: CVE-2026-5241 Source advisory: OSV:GHSA-FGCW-684Q-JJ6R...

aitoolbox (>=1.0.0, <=1.1.0), allencv (>=0.1.0, <=0.1.1) +59 more potentially affected by CVE-2026-5241 via transformers (4.20.1)

transformers PYPI version 4.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aitoolbox =1.0.0, =0.1.0, =2.10.0, =0.1.0, =0.0.3, =2.10.0, =0.1.0, =0.0.3, =0.0.1, =0.0.1, =0.0.2, =0.4.3b20220621, =0.4.3b20220621,...

autogluon (>=0.3.2b20220126, <=0.4.1b20220317), gen2-connector (>=1.0.0b48, <=1.0.0b56) +2 more potentially affected by CVE-2026-41486 via ray (1.8.0)

ray PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - autogluon =0.3.2b20220126, =1.0.0b48, =0.0.7.post1, =0.1.0b0, =0.1.3 Source cves: CVE-2026-41486 Source advisory: OSV:PYSEC-2026-2272...

autogluon (>=0.3.2b20211214, <=0.3.2b20220125), msapy (>=0.0.1, <=1.0.0) potentially affected by CVE-2026-41486 via ray (1.7.1)

ray PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - autogluon =0.3.2b20211214, =0.0.1, =1.0.0 Source cves: CVE-2026-41486 Source advisory: OSV:PYSEC-2026-2272...

autogluon (>=0.3.2b20211214, <=0.3.2b20220125), msapy (>=0.0.1, <=1.0.0) potentially affected by CVE-2025-62593 via ray (1.7.1)

ray PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - autogluon =0.3.2b20211214, =0.0.1, =1.0.0 Source cves: CVE-2025-62593 Source advisory: OSV:GHSA-Q279-JHRF-CC6V...

abmarl (>=0.2.3, <=0.2.4), autogluon (>=0.4.3b20220611, <=0.4.3b20220617) +4 more potentially affected by CVE-2025-62593 via ray (1.12.1)

ray PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - abmarl =0.2.3, =0.4.3b20220611, =3.1.1, =2022.7.7.dev1, =1.2.0, =1.2.1 Source cves: CVE-2025-62593 Source advisory: OSV:GHSA-Q279-JHRF-CC6V...

adaswarm (>=0.0.1, <=0.0.2), allennlp (>=2.8.0, <=2.9.1) +81 more potentially affected by CVE-2025-3000 via torch (1.10.2)

torch PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - adaswarm =0.0.1, =2.8.0, =2.8.0, =0.1.0, =0.2.1b20210731, =0.4.3b20220616, =0.3.2b20220222, =1.0.0, =1.40.0, =0.1.0, =0.1.2, =0.2.8 -...

autogluon (0.0.5), bliz (>=0.1.0, <=0.1.3) +25 more potentially affected by CVE-2024-5206 via scikit-learn (0.21.2)

scikit-learn PYPI version 0.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - autogluon 0.0.5 - bliz =0.1.0, =0.0.70, =0.1.18, =1.0.0, =0.8.0, =0.2.0, =0.0.1, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.0.3, =0.0.14 and mo...

autogluon (0.0.5), bliz (>=0.1.0, <=0.1.3) +25 more potentially affected by CVE-2024-5206 via scikit-learn (0.21.2)

scikit-learn PYPI version 0.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - autogluon 0.0.5 - bliz =0.1.0, =0.0.70, =0.1.18, =1.0.0, =0.8.0, =0.2.0, =0.0.1, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.0.3, =0.0.14 and mo...

al-for-design (0.0.1), autogluon (>=0.0.5, <=0.1.0b20210209) +48 more potentially affected by CVE-2023-50447 via pillow (6.2.1)

pillow PYPI version 6.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - al-for-design 0.0.1 - autogluon =0.0.5, =0.0.15b20201014, =0.0.15b20201024, =0.0.16b20210114, =0.0.15b20201024, =0.0.121, =0.0.1, =0.0.1, =0.0.1,...

autogluon.multimodal vulnerable to unsafe YAML deserialization

Impact A potential unsafe deserialization issue exists within the autogluon.multimodal module, where YAML files are loaded via yaml.load instead of yaml.safeload. The deserialization of untrusted data may allow an unprivileged third party to cause remote code execution, denial of service, and...

GHSA-6H2X-4GJF-JC5W autogluon.multimodal vulnerable to unsafe YAML deserialization

Impact A potential unsafe deserialization issue exists within the autogluon.multimodal module, where YAML files are loaded via yaml.load instead of yaml.safeload. The deserialization of untrusted data may allow an unprivileged third party to cause remote code execution, denial of service, and...

al-for-design (0.0.1), autogluon (>=0.0.5, <=0.1.0b20210209) +48 more potentially affected by CVE-2022-24303 via pillow (6.2.1)

pillow PYPI version 6.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - al-for-design 0.0.1 - autogluon =0.0.5, =0.0.15b20201014, =0.0.15b20201024, =0.0.16b20210114, =0.0.15b20201024, =0.0.121, =0.0.1, =0.0.1, =0.0.1,...

al-for-design (0.0.1), autogluon (>=0.0.5, <=0.1.0b20210209) +48 more potentially affected by CVE-2021-27921 via pillow (6.2.1)

pillow PYPI version 6.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - al-for-design 0.0.1 - autogluon =0.0.5, =0.0.15b20201014, =0.0.15b20201024, =0.0.16b20210114, =0.0.15b20201024, =0.0.121, =0.0.1, =0.0.1, =0.0.1,...