Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses pdfminersix-20251107-py3-none-any.whl, requests-2.32.5-py3-none-any.whl, langchaincore-0.3.81-py3-none-any.whl, pythondotenv-1.0.1-py3-none-any.whl, langchaintextsplitters-0.3.11-py3-none-any.whl, qs-6.15.1.tgz, idna-3.10-py3-none-any.whl, idna-3.14-py3-none-any.whl...

a2 (>=0.4.9, <=0.8.3), abadpour (>=6.13.1, <=7.24.1) +940 more potentially affected by CVE-2026-10803 via mlflow-skinny (>=1.19.0, <=3.15.1)

mlflow-skinny PYPI version =1.19.0, =0.4.9, =6.13.1, =9.273.1, =1.1.0, =0.1.0, =0.1.0, =0.4.4, =0.3.0, =0.1.0, =1.0.0, =0.1.0, =1.1.1 - ai-helpers-pytorch-utils 0.1.0a1 and more Source cves: CVE-2026-10803 Source advisory: SNYK:PYTHON-MLFLOWSKINNY-17173042...

a2 (>=0.1.0, <=0.3.17), abadpour (>=6.13.1, <=7.24.1) +972 more potentially affected by CVE-2026-10803 via mlflow (>=0.8.2, <=3.15.1)

mlflow PYPI version =0.8.2, =0.1.0, =6.13.1, =9.273.1, =1.1.0, =0.1.0, =0.1.0, =0.4.4, =0.3.0, =0.0.5, =1.0.0, =0.1.0, =1.1.1 - ai-helpers-pytorch-utils 0.1.0a1 - aidevelopementtoolkit 0.2.0 and more Source cves: CVE-2026-10803 Source advisory: SNYK:PYTHON-MLFLOW-17173043...

CVE-2026-10803

A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digestutils of the file mlflow/data/digestutils.py of the component Dataset Digest Computation. This manipulation causes use of weak hash. It is possible to launch the attack on the local host. The attack is...

CVE-2026-10803

MLflow up to 3.10.0 contains a flaw in mlflow.data.digest_utils (Digest Computation) where manipulation leads to use of a weak hash. This affects the Digest Utils function in the Dataset Digest Computation component and enables a local attack. The reported exploitability is high in complexity wit...