pdfmerge (1.0.0), ribometric (>=0.1.4, <=0.1.12) potentially affected by CVE-2026-102998 via pypdf (3.9.0)

pypdf PYPI version 3.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pdfmerge 1.0.0 - ribometric =0.1.4, =0.1.12 Source cves: CVE-2026-102998 Source advisory: OSV:PYSEC-2026-4157...