farm-haystack (>=0.10.0, <=1.0.0), kserve (>=0.7.0rc0, <=0.7.0) potentially affected by CVE-2023-48022 +4 more via ray (1.5.0)

ray PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - farm-haystack =0.10.0, =0.7.0rc0, =0.7.0 Source cves: CVE-2023-48022, CVE-2023-48023, CVE-2023-6019, CVE-2023-6020, CVE-2023-6021 Source advisory:...

biome-text (>=3.0.0, <=3.2.1), farm (>=0.6.2, <=0.8.0) +5 more potentially affected by CVE-2023-6014 via mlflow (1.13.1)

mlflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text =3.0.0, =0.6.2, =0.7.0, =0.0.1, =1.1.0, =1.0.0, =0.4.5.dev2, =0.6.5 Source cves: CVE-2023-6014 Source advisory: OSV:PYSEC-2026-415...

llama2-terminal (>=0.1.1, <=0.1.6) potentially affected by CVE-2023-1712 via farm-haystack (0.8.0)

farm-haystack PYPI version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on farm-haystack and may be impacted: - llama2-terminal =0.1.1, =0.1.6 Source cves: CVE-2023-1712 Source advisory: OSV:PYSEC-2026-337...

mapintel (1.0.0), ocrpy (0.3.9) potentially affected by CVE-2023-1712 via farm-haystack (>=1.6.0, <=1.12.2)

farm-haystack PYPI version =1.6.0, =1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on farm-haystack and may be impacted: - mapintel 1.0.0 - ocrpy 0.3.9 Source cves: CVE-2023-1712 Source advisory: OSV:PYSEC-2026-337...

Use of hard-coded, security-relevant constants in deepset-ai/haystack

Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack in version 1.15.0 and prior. A patch is available at commit 5fc84904f198de661d5b933fde756aa922bf09f1...

PYSEC-2026-337 Use of hard-coded, security-relevant constants in deepset-ai/haystack

Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack in version 1.15.0 and prior. A patch is available at commit 5fc84904f198de661d5b933fde756aa922bf09f1...

farm-haystack (>=0.10.0, <=1.0.0), kserve (>=0.7.0rc0, <=0.7.0) potentially affected by CVE-2025-34351 via ray (1.5.0)

ray PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - farm-haystack =0.10.0, =0.7.0rc0, =0.7.0 Source cves: CVE-2025-34351 Source advisory: OSV:PYSEC-2026-518...

farm-haystack (>=0.10.0, <=1.0.0), kserve (>=0.7.0rc0, <=0.7.0) potentially affected by CVE-2025-62593 via ray (1.5.0)

ray PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - farm-haystack =0.10.0, =0.7.0rc0, =0.7.0 Source cves: CVE-2025-62593 Source advisory: OSV:PYSEC-2026-520...

PT-2026-53428

Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack in version 1.15.0 and prior. A patch is available at commit 5fc84904f198de661d5b933fde756aa922bf09f1...

farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2026-10803 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2026-10803 Source advisory: OSV:PYSEC-2026-195...

biome-text (>=3.0.0, <=3.2.1), farm (>=0.6.2, <=0.8.0) +5 more potentially affected by CVE-2026-10803 via mlflow (1.13.1)

mlflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text =3.0.0, =0.6.2, =0.7.0, =0.0.1, =1.1.0, =1.0.0, =0.4.5.dev2, =0.6.5 Source cves: CVE-2026-10803 Source advisory: OSV:PYSEC-2026-195...

crslab (0.1.1), farm (>=0.6.0, <=0.7.1) +6 more potentially affected by CVE-2026-5241 via transformers (4.1.1)

transformers PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - crslab 0.1.1 - farm =0.6.0, =0.0.1, =0.0.2, =0.0.4, =0.0.2, =0.0.1, =0.0.2 Source cves: CVE-2026-5241 Source advisory:...

adamix-gpt2 (>=0.0.1, <=0.0.2), allennlp (>=1.2.0rc1.dev20200930, <=1.2.0rc1.dev20201021) +6 more potentially affected by CVE-2026-5241 via transformers (3.3.1)

transformers PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adamix-gpt2 =0.0.1, =1.2.0rc1.dev20200930, =1.2.0rc1.dev20201007, =0.0.1, =0.5.0, =0.1.11, =0.1.12 - mc-transformers 0.1.11 Source cves:...

allennlp (1.2.0rc1.dev20200923), awca (>=0.0.2, <=0.0.3.2) +9 more potentially affected by CVE-2026-5241 via transformers (3.1.0)

transformers PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp 1.2.0rc1.dev20200923 - awca =0.0.2, =0.2.4, =0.4.8, =1.1.1, =1.1.0.dev202009251125, =2.1.0, =1.0.1, =1.1.0 Source cves:...

allennlp (>=2.5.1.dev20210622, <=2.5.1.dev20210623), farm-haystack (1.0.0) +4 more potentially affected by CVE-2026-5241 via transformers (4.7.0)

transformers PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.5.1.dev20210622, =0.1.0, =0.3.0 Source cves: CVE-2026-5241 Source advisory: OSV:GHSA-FGCW-684Q-JJ6R...

deepspeed-mii (>=0.0.1, <=0.0.2), farm-haystack (>=1.9.0rc1, <=1.11.1) +5 more potentially affected by CVE-2026-5241 via transformers (4.21.2)

transformers PYPI version 4.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - deepspeed-mii =0.0.1, =1.9.0rc1, =1.0.0, =0.2.13.dev20230218132015, =0.1.5, =0.0.2, =0.0.7 Source cves: CVE-2026-5241 Source advisory:...

farm-haystack (>=1.1.0, <=1.4.0), pysentimiento (>=0.4.0, <=0.4.2) +1 more potentially affected by CVE-2026-5241 via transformers (4.13.0)

transformers PYPI version 4.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - farm-haystack =1.1.0, =0.4.0, =1.8.3, =1.8.4 Source cves: CVE-2026-5241 Source advisory: OSV:GHSA-FGCW-684Q-JJ6R...

aihandler (>=1.10.3, <=1.15.6), airunner (>=1.11.0, <=1.16.9) +5 more potentially affected by CVE-2026-5241 via transformers (4.29.1)

transformers PYPI version 4.29.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aihandler =1.10.3, =1.11.0, =1.17.0rc1, =1.17.2 - instruct-qa 0.0.3rc1 - konta-test 0.1.0 - konta-testing 0.1.0 - vietlm 0.1.0 Source...

crslab (0.1.1), farm (>=0.6.0, <=0.7.1) +6 more potentially affected by CVE-2026-5241 via transformers (4.1.1)

transformers PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - crslab 0.1.1 - farm =0.6.0, =0.0.1, =0.0.2, =0.0.4, =0.0.2, =0.0.1, =0.0.2 Source cves: CVE-2026-5241 Source advisory: OSV:PYSEC-2026-22...

allennlp (>=2.5.1.dev20210622, <=2.5.1.dev20210623), farm-haystack (1.0.0) +4 more potentially affected by CVE-2026-5241 via transformers (4.7.0)

transformers PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.5.1.dev20210622, =0.1.0, =0.3.0 Source cves: CVE-2026-5241 Source advisory: OSV:PYSEC-2026-2290...