farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2026-2635 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2026-2635 Source advisory: OSV:GHSA-GQ3W-7JJ3-X7GR...

farm-haystack (>=0.10.0, <=1.0.0), kserve (>=0.7.0rc0, <=0.7.0) potentially affected by CVE-2026-27482 via ray (1.5.0)

ray PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - farm-haystack =0.10.0, =0.7.0rc0, =0.7.0 Source cves: CVE-2026-27482 Source advisory: OSV:GHSA-Q5FH-2HC8-F6RQ...

farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2025-10279 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2025-10279 Source advisory: OSV:GHSA-4X5P-F36R-MXXR...

lightspeed-stack (>=0.1.1, <=0.4.0), lightspeed-stack-providers (>=0.1.10, <=0.1.18) +5 more potentially affected by CVE-2026-25211 via llama-stack (>=0.2.9, <=0.3.5)

llama-stack PYPI version =0.2.9, =0.1.1, =0.1.10, =1.0.1, =0.3.4, =0.1.0, =0.2.0, =0.3.0a0 Source cves: CVE-2026-25211 Source advisory: SNYK:PYTHON-LLAMASTACK-15166608...

lightspeed-stack (>=0.1.1, <=0.4.2), lightspeed-stack-providers (>=0.1.10, <=0.4.3) +5 more potentially affected by CVE-2026-25211 via llama-stack (>=0.2.9, <=0.4.3)

llama-stack PYPI version =0.2.9, =0.1.1, =0.1.10, =1.0.1, =0.3.4, =0.1.0, =0.2.0, =0.3.0a0 Source cves: CVE-2026-25211 Source advisory: GHSA-XMFJ-7PP5-FXR6...

lightspeed-stack (>=0.1.1, <=0.4.2), lightspeed-stack-providers (>=0.1.10, <=0.4.3) +5 more potentially affected by CVE-2026-25211 via llama-stack (>=0.2.9, <=0.4.3)

llama-stack PYPI version =0.2.9, =0.1.1, =0.1.10, =1.0.1, =0.3.4, =0.1.0, =0.2.0, =0.3.0a0 Source cves: CVE-2026-25211 Source advisory: MEND:CVE-2026-25211...

farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2025-14279 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2025-14279 Source advisory: OSV:GHSA-PGQP-8H46-6X4J...

crslab (0.1.1), farm (>=0.6.0, <=0.7.1) +6 more potentially affected by CVE-2025-14929 via transformers (4.1.1)

transformers PYPI version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - crslab 0.1.1 - farm =0.6.0, =0.0.1, =0.0.2, =0.0.4, =0.0.2, =0.0.1, =0.0.2 Source cves: CVE-2025-14929 Source advisory: OSV:PYSEC-2025-2...

allennlp (>=2.5.1.dev20210622, <=2.5.1.dev20210623), farm-haystack (1.0.0) +4 more potentially affected by CVE-2025-14929 via transformers (4.7.0)

transformers PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.5.1.dev20210622, =0.1.0, =0.3.0 Source cves: CVE-2025-14929 Source advisory: OSV:PYSEC-2025-217...

allennlp (1.2.0rc1.dev20200923), awca (>=0.0.2, <=0.0.3.2) +9 more potentially affected by CVE-2025-14921 via transformers (3.1.0)

transformers PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp 1.2.0rc1.dev20200923 - awca =0.0.2, =0.2.4, =0.4.8, =1.1.1, =1.1.0.dev202009251125, =2.1.0, =1.0.1, =1.1.0 Source cves:...

allennlp (1.2.0rc1.dev20200923), awca (>=0.0.2, <=0.0.3.2) +9 more potentially affected by CVE-2025-14920 via transformers (3.1.0)

transformers PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp 1.2.0rc1.dev20200923 - awca =0.0.2, =0.2.4, =0.4.8, =1.1.1, =1.1.0.dev202009251125, =2.1.0, =1.0.1, =1.1.0 Source cves:...

farm-haystack (>=0.10.0, <=1.0.0), kserve (>=0.7.0rc0, <=0.7.0) potentially affected by CVE-2025-34351 via ray (1.5.0)

ray PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - farm-haystack =0.10.0, =0.7.0rc0, =0.7.0 Source cves: CVE-2025-34351 Source advisory: OSV:GHSA-GX77-XGC2-4888...

farm-haystack (>=0.10.0, <=1.0.0), kserve (>=0.7.0rc0, <=0.7.0) potentially affected by CVE-2025-62593 via ray (1.5.0)

ray PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - farm-haystack =0.10.0, =0.7.0rc0, =0.7.0 Source cves: CVE-2025-62593 Source advisory: OSV:GHSA-Q279-JHRF-CC6V...

Jailbreaking in the Haystack

Recent advances in long-context language models LMs have enabled million-token inputs, expanding their capabilities across complex tasks like computer-use agents. Yet, the safety implications of these extended contexts remain unclear. To bridge this gap, we introduce NINJA short for...

farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2025-11200 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2025-11200 Source advisory: OSV:GHSA-6XJ8-RRQX-R4CV...

biome-text (>=3.0.0, <=3.2.1), farm (>=0.6.2, <=0.8.0) +5 more potentially affected by CVE-2025-11201 via mlflow (1.13.1)

mlflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text =3.0.0, =0.6.2, =0.7.0, =0.0.1, =1.1.0, =1.0.0, =0.4.5.dev2, =0.6.5 Source cves: CVE-2025-11201 Source advisory: OSV:GHSA-5CVJ-7RG6-JGGJ...

biome-text (>=3.0.0, <=3.2.1), farm (>=0.6.2, <=0.8.0) +5 more potentially affected by CVE-2025-11200 via mlflow (1.13.1)

mlflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text =3.0.0, =0.6.2, =0.7.0, =0.0.1, =1.1.0, =1.0.0, =0.4.5.dev2, =0.6.5 Source cves: CVE-2025-11200 Source advisory: OSV:GHSA-6XJ8-RRQX-R4CV...

EUVD-2024-2367

Malicious code in bioql PyPI...

lightspeed-stack (>=0.1.1, <=0.2.0), lightspeed-stack-providers (>=0.1.10, <=0.1.15) +3 more potentially affected by CVE-2025-55178 via llama-stack (>=0.2.9, <=0.2.18)

llama-stack PYPI version =0.2.9, =0.1.1, =0.1.10, =1.0.1, =0.2.0, =0.3.0a0 Source cves: CVE-2025-55178 Source advisory: OSV:GHSA-X75H-M6JJ-6CJ2...

lightspeed-stack (>=0.1.1, <=0.2.0), lightspeed-stack-providers (>=0.1.10, <=0.1.15) +3 more potentially affected by CVE-2025-55178 via llama-stack (>=0.2.9, <=0.2.18)

llama-stack PYPI version =0.2.9, =0.1.1, =0.1.10, =1.0.1, =0.2.0, =0.3.0a0 Source cves: CVE-2025-55178 Source advisory: GHSA-X75H-M6JJ-6CJ2...