Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-1839,CVE-2025-14920, CVE-2026-4372

Summary IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-1839,CVE-2025-14920,CVE-2026-4372. This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2025-14920 DESCRIPTION: Huggi...

CVE-2026-4372 vulnerabilities

Vulnerabilities for packages: nemo, tritonserver-backend-vllm-cuda-12.9, text-generation-inference...

bert-summarizer (0.0.6) potentially affected by CVE-2026-4372 via transformers (4.0.0rc1)

transformers PYPI version 4.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - bert-summarizer 0.0.6 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

slp (>=1.2.0, <=1.2.1) potentially affected by CVE-2026-4372 via transformers (4.3.0)

transformers PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - slp =1.2.0, =1.2.1 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

alignment-handbook (0.2.0), decoders (0.1.0) +12 more potentially affected by CVE-2026-4372 via transformers (4.35.0)

transformers PYPI version 4.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - alignment-handbook 0.2.0 - decoders 0.1.0 - dragon-baseline =0.1.0, =0.1.0, =0.3.1, =0.0.14, =0.1.2, =0.82.0, =0.1.0, =0.1.0, =0.9.2,...

aces-metric (>=0.0.3, <=0.0.4), adaptor (>=0.2.3, <=0.2.5) +51 more potentially affected by CVE-2026-4372 via transformers (4.30.2)

transformers PYPI version 4.30.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aces-metric =0.0.3, =0.2.3, =0.0.1, =0.0.6, =0.0.1, =0.1.1, =2.3.0, =0.1.3, =2.7.0, =0.10.3, =0.1.2, =0.2.0, =0.3.1 and more Source cve...

name-entity-extraction-for-contextual-embedding (>=0.3.0, <=0.5.0) potentially affected by CVE-2026-4372 via transformers (4.2.0)

transformers PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - name-entity-extraction-for-contextual-embedding =0.3.0, =0.5.0 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

aitoolbox (>=1.0.0, <=1.1.0), allencv (>=0.1.0, <=0.1.1) +59 more potentially affected by CVE-2026-4372 via transformers (4.20.1)

transformers PYPI version 4.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aitoolbox =1.0.0, =0.1.0, =2.10.0, =0.1.0, =0.0.3, =2.10.0, =0.1.0, =0.0.3, =0.0.1, =0.0.1, =0.0.2, =0.4.3b20220621, =0.4.3b20220621,...

augly-jp (>=2021.9.6, <=2021.9.26), biome-text (3.3.0) +10 more potentially affected by CVE-2026-4372 via transformers (4.9.2)

transformers PYPI version 4.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - augly-jp =2021.9.6, =1.2.1, =0.1.0, =1.0.4, =1.0.6 - tkittagger 0.0.0.2 - wafl 0.0.1 - zero-shot-re 0.0.4 Source cves: CVE-2026-4372...

langchain-timbr (>=2.1.0, <=3.3.0), otat (>=0.1.0, <=0.1.3) +5 more potentially affected by CVE-2026-4372 via transformers (4.57.0)

transformers PYPI version 4.57.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - langchain-timbr =2.1.0, =0.1.0, =1.0.1, =0.5.3rc2, =1.1.4, =0.0.1, =0.1.3 - vllm-kunlun 0.11.1 Source cves: CVE-2026-4372 Source...

aiu-fms-testing-utils (>=0.1.0rc3, <=0.2.0), avalan (>=1.2.14, <=1.2.15) +62 more potentially affected by CVE-2026-4372 via transformers (4.53.3)

transformers PYPI version 4.53.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aiu-fms-testing-utils =0.1.0rc3, =1.2.14, =0.20.0, =0.1.22, =1.0.0, =0.1.0, =0.3.11, =1.1.12, =3.0.2, =0.18.0, =0.2.3, =1.0.0, =0.6.0rc...

adapters (1.1.0), advtok (0.0.2) +44 more potentially affected by CVE-2026-4372 via transformers (4.47.1)

transformers PYPI version 4.47.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adapters 1.1.0 - advtok 0.0.2 - akasha-terminal =0.9.0, =0.1.0, =1.3.0, =0.3.7, =2.1.7, =0.0.1, =1.0.0, =0.1.2, =0.1.55, =0.1.62 and mo...

enot-autodl (>=3.3.1, <=3.4.3), farm-haystack (1.5.0) +6 more potentially affected by CVE-2026-4372 via transformers (4.19.2)

transformers PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - enot-autodl =3.3.1, =0.7.2, =0.2.0, =2.1.0, =2.1.2 - textdiversity 0.0.1 Source cves: CVE-2026-4372 Source advisory:...

orkgnlp (>=0.5.0, <=0.11.2) potentially affected by CVE-2026-4372 via transformers (4.19.3)

transformers PYPI version 4.19.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - orkgnlp =0.5.0, =0.11.2 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

allophant (1.0.0), at-20250801 (0.1.0) +50 more potentially affected by CVE-2026-4372 via transformers (4.41.2)

transformers PYPI version 4.41.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allophant 1.0.0 - at-20250801 0.1.0 - atomgpt 2024.11.30 - audiotoken 0.1.0 - autotrain-advanced =0.7.119, =0.0.1, =0.2.24, =1.0.1,...

adapters (0.1.2), azureml-automl-dnn-nlp (1.55.0) +64 more potentially affected by CVE-2026-4372 via transformers (4.36.2)

transformers PYPI version 4.36.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adapters 0.1.2 - azureml-automl-dnn-nlp 1.55.0 - bcembedding =0.1.4, =0.1.0, =0.2.2, =0.0.1, =1.0.0, =0.3.4, =0.0.1rc7, =1.0.18, =0.0.1...

allennlp (>=2.5.0.dev20210603, <=2.5.1.dev20210621), allennlp-models (2.5.0) +22 more potentially affected by CVE-2026-4372 via transformers (4.6.1)

transformers PYPI version 4.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.5.0.dev20210603, =0.0.10, =3.1.0, =2.0.0, =0.0.1, =0.0.1, =2.0.0a0, =0.9.0, =0.0.29, =0.16.0rc0, =1.0.5, =0.0.8, =0.0.9 and...

dlk (>=0.0.1, <=0.0.4), pyannotators-trfclassifier (>=0.5.79, <=0.5.85) +5 more potentially affected by CVE-2026-4372 via transformers (4.12.0)

transformers PYPI version 4.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - dlk =0.0.1, =0.5.79, =0.5.182, =0.5.39, =0.5.185, =0.5.98, =0.5.55, =0.5.59 Source cves: CVE-2026-4372 Source advisory:...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2026-4372 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

academic-emotion (0.1.2), aqlm (>=1.0.0, <=1.0.1) +10 more potentially affected by CVE-2026-4372 via transformers (4.37.0)

transformers PYPI version 4.37.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - academic-emotion 0.1.2 - aqlm =1.0.0, =0.6.81, =1.1.0, =3.6.1, =0.1.1, =0.1.3, =0.0.4, =0.2.1, =0.10.0, =0.18.2 Source cves:...