pytorch-segmentation-models-trainer (0.7.0), ratsnlp (0.0.9993) potentially affected by CVE-2024-5980 via pytorch-lightning (1.3.7)

pytorch-lightning PYPI version 1.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.7.0 - ratsnlp 0.0.9993 Source cves: CVE-2024-5980 Source advisory: OSV:PYSEC-2026-3975...

paoding (0.1.1), pytorch-segmentation-models-trainer (0.12.0) potentially affected by CVE-2024-5980 via pytorch-lightning (1.4.8)

pytorch-lightning PYPI version 1.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - paoding 0.1.1 - pytorch-segmentation-models-trainer 0.12.0 Source cves: CVE-2024-5980 Source advisory: OSV:PYSEC-2026-3975...

pytorch-segmentation-models-trainer (0.7.0), ratsnlp (0.0.9993) potentially affected by CVE-2024-5452 via pytorch-lightning (1.3.7)

pytorch-lightning PYPI version 1.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.7.0 - ratsnlp 0.0.9993 Source cves: CVE-2024-5452 Source advisory: OSV:PYSEC-2026-3974...

pytorch-segmentation-models-trainer (0.11.0) potentially affected by CVE-2024-5452 via pytorch-lightning (1.4.3)

pytorch-lightning PYPI version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.11.0 Source cves: CVE-2024-5452 Source advisory: OSV:PYSEC-2026-3974...

chemprobe (0.1.5), finetuning-scheduler (0.3.3) +1 more potentially affected by CVE-2024-5452 via pytorch-lightning (1.8.4)

pytorch-lightning PYPI version 1.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - chemprobe 0.1.5 - finetuning-scheduler 0.3.3 - uncertainty-estimation-models 0.1.0 Source cves: CVE-2024-5452 Source advisory:...

paoding (0.1.1), pytorch-segmentation-models-trainer (0.12.0) potentially affected by CVE-2024-5452 via pytorch-lightning (1.4.8)

pytorch-lightning PYPI version 1.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - paoding 0.1.1 - pytorch-segmentation-models-trainer 0.12.0 Source cves: CVE-2024-5452 Source advisory: OSV:PYSEC-2026-3974...

finetuning-scheduler (0.2.1), nlhappy (2022.9.14) +1 more potentially affected by CVE-2024-5452 via pytorch-lightning (1.7.1)

pytorch-lightning PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - finetuning-scheduler 0.2.1 - nlhappy 2022.9.14 - pytorch-segmentation-models-trainer 0.17.0 Source cves: CVE-2024-5452 Source...

eargait (3.0.0), pytorch-segmentation-models-trainer (>=0.16.0, <=0.16.1) potentially affected by CVE-2024-5452 via pytorch-lightning (1.5.3)

pytorch-lightning PYPI version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - eargait 3.0.0 - pytorch-segmentation-models-trainer =0.16.0, =0.16.1 Source cves: CVE-2024-5452 Source advisory:...

allennlp (>=2.5.1.dev20210625, <=2.6.0), allennlp-models (>=2.5.0.dev20210603, <=2.6.0) +16 more potentially affected by CVE-2026-9856 via transformers (4.8.2)

transformers PYPI version 4.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.5.1.dev20210625, =2.5.0.dev20210603, =0.0.1rc19, =0.1.5, =0.0.2, =0.0.4, =0.2.0, =0.12.3, =0.1.0, =0.1.1, =0.2.3, =0.2.0,...

allennlp (>=1.0.0rc4.dev20200513, <=1.0.0rc6.dev20200601), allennlp-models (>=1.0.0rc4, <=1.0.0rc5) potentially affected by CVE-2026-9856 via transformers (2.9.1)

transformers PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.0.0rc4.dev20200513, =1.0.0rc4, =1.0.0rc5 Source cves: CVE-2026-9856 Source advisory: OSV:PYSEC-2026-3929...

allennlp (>=1.2.0rc1.dev20201022, <=1.2.1), allennlp-models (>=1.2.0rc1.dev20201022, <=1.2.1) +5 more potentially affected by CVE-2026-9856 via transformers (3.4.0)

transformers PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.2.0rc1.dev20201022, =1.2.0rc1.dev20201022, =0.0.4, =0.0.1, =2.2.5, =2.3.1 Source cves: CVE-2026-9856 Source advisory:...

allennlp (>=1.0.0rc6.dev20200602, <=1.1.0rc1.dev20200706), allennlp-models (>=1.1.0rc1.dev20200630, <=1.1.0rc1.dev20200706) +6 more potentially affected by CVE-2026-9856 via transformers (2.10.0)

transformers PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.0.0rc6.dev20200602, =1.1.0rc1.dev20200630, =0.0.6, =2.7.3, =0.2.15, =0.2.0, =0.3.0 Source cves: CVE-2026-9856 Source...

allennlp (>=2.8.0, <=2.9.0.dev20211215), allennlp-models (2.8.0) +8 more potentially affected by CVE-2026-9856 via transformers (4.12.5)

transformers PYPI version 4.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.8.0, =0.0.1rc158945962037, =0.1.2, =0.0.12, =0.0.0.116399031, =0.0.0.116461994 - transformers-embedder 1.8.2 Source cves:...

allennlp (>=0.9.1.dev20200415, <=1.0.0rc4.dev20200511), allennlp-models (>=1.0.0rc2, <=1.0.0rc3) +6 more potentially affected by CVE-2026-9856 via transformers (2.8.0)

transformers PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200415, =1.0.0rc2, =0.1.9, =0.0.2, =0.1.0, =0.3.2 Source cves: CVE-2026-9856 Source advisory: OSV:PYSEC-2026-3929...

allennlp (>=2.2.1.dev20210408, <=2.7.0), allennlp-dataframe-mapper (0.2.1) +20 more potentially affected by CVE-2026-9856 via transformers (4.5.1)

transformers PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.2.1.dev20210408, =2.2.1.dev20210329, =0.0.0.2, =1.37.0, =0.0.1, =0.1.0, =0.3.0b1, =0.0.1, =1.0.23, =1.1.3 - nlp-nn 0.0.11.0...

bluecore-models (>=0.11.1, <=0.25.0), orilinx (1.0.1) potentially affected by CVE-2026-9856 via transformers (4.57.5)

transformers PYPI version 4.57.5 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - bluecore-models =0.11.1, =0.25.0 - orilinx 1.0.1 Source cves: CVE-2026-9856 Source advisory: OSV:PYSEC-2026-3929...

allennlp (1.3.0), allennlp-models (1.3.0) +3 more potentially affected by CVE-2026-9856 via transformers (4.0.1)

transformers PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp 1.3.0 - allennlp-models 1.3.0 - indic-punct =2.0.7, =1.0.0.dev0, =0.6.1.dev0, =0.6.9 Source cves: CVE-2026-9856 Source advisory...

aiu-fms-testing-utils (0.0.2a3), pathology-foundation-models (>=0.0.2, <=0.0.4) +1 more potentially affected by CVE-2026-9856 via transformers (4.54.0)

transformers PYPI version 4.54.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aiu-fms-testing-utils 0.0.2a3 - pathology-foundation-models =0.0.2, =0.1.0, =0.1.1 Source cves: CVE-2026-9856 Source advisory:...

CVE-2026-88000

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/id/messages/messageid used the chat-history deletion helper in backend/openwebui/models/chats.py to follow childrenIds without recording visited message identifiers...

CVE-2026-87016

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, getuserbyoauthsub and getuserbyscimexternalid in backend/openwebui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject...