CLSA-2026-1790851862 TuxCare security update for sentence-transformers (1 CVE)

TuxCare rebuilt sentence-transformers to address 1 CVE. Fixed in 2.7.0.post3+tuxcare...

CLSA-2026-1790831175 TuxCare security update for transformers (1 CVE)

TuxCare rebuilt transformers to address 1 CVE. Fixed in 4.57.6.post5+tuxcare...

PT-2026-105908

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import module class helper within sentence transformers/util/misc.py, where the guard condition includes an 'or os.path.existsmodel na...

PT-2026-105917

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load custom generate. The function fetches and caches a remote module file before performing the required trust...

pocolate

pocolate Standalone, parameterized PoCs for AI-infrastructure...

Security Bulletin: Multiple vulnerabilities in IBM MQ Agent images

Summary Multiple vulnerabilities were addressed in IBM MQ Agent images Vulnerability Details CVEID:CVE-2026-75104 DESCRIPTION: Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers c...

Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem

Summary Multiple vulnerabilities were addressed in IBM watsonx Code Assistant On Prem V5.3.1 Patch 12 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to FormDataappend a...

ROOT-APP-PYPI-CVE-2026-9856 CVE-2026-9856 in transformers - Patched by Root

Root has patched CVE-2026-9856 in the transformers package for Root:PyPI. Multiple fixed versions available...

Malicious code in transfomers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df75802d76ea42dd9a4e543e30565723bfaed892475cbeaca7ef561a67c1f0b3 Package name typosquats the popular transformers library. The distribution installs a .pth file into site-packages, which the Python interpreter...

autogluon (>=0.4.1b20220511, <=0.5.3b20221005), autogluon-multimodal (>=0.4.3b20220616, <=0.5.3b20221005) +38 more potentially affected by CVE-2024-5980 via pytorch-lightning (1.6.5.post0)

pytorch-lightning PYPI version 1.6.5.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - autogluon =0.4.1b20220511, =0.4.3b20220616, =0.4.1b20220511, =1.0.0, =0.1.3, =0.5.33, =0.1.5, =0.6.0, =0.6.1, =0.47.0,...

autotrain-advanced (>=0.8.9, <=0.8.11), dgenerate (>=4.2.0, <=4.2.3) +11 more potentially affected by CVE-2026-9856 via transformers (4.44.0)

transformers PYPI version 4.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.8.9, =4.2.0, =0.1.1, =1.0.0, =0.1.0, =0.1.4, =0.3.8, =0.4.0, =0.1.1, =1.0.0, =0.1.0, =0.1.1, =0.1.7 Source cves:...

classy-core (0.1.0a0), disformers (>=0.0.1, <=0.10.7) +2 more potentially affected by CVE-2026-9856 via transformers (4.11.0)

transformers PYPI version 4.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - classy-core 0.1.0a0 - disformers =0.0.1, =0.10.7 - pyconverse 0.1.0 - zeroshot-topics 0.1.0 Source cves: CVE-2026-9856 Source advisory:...

autotrain-advanced (>=0.6.52, <=0.6.80), bicleaner-ai (>=3.0.1, <=3.2.1) +5 more potentially affected by CVE-2026-9856 via transformers (4.36.1)

transformers PYPI version 4.36.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.6.52, =3.0.1, =0.1.4, =0.0.2, =0.0.12 Source cves: CVE-2026-9856 Source advisory: OSV:PYSEC-2026-3929...

augly-jp (>=2021.9.6, <=2021.9.26), biome-text (3.3.0) +10 more potentially affected by CVE-2026-9856 via transformers (4.9.2)

transformers PYPI version 4.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - augly-jp =2021.9.6, =1.2.1, =0.1.0, =1.0.4, =1.0.6 - tkittagger 0.0.0.2 - wafl 0.0.1 - zero-shot-re 0.0.4 Source cves: CVE-2026-9856...

aait (>=1.0.0.0, <=2.3.14), adapters (1.2.0) +87 more potentially affected by CVE-2026-9856 via transformers (4.51.3)

transformers PYPI version 4.51.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aait =1.0.0.0, =0.3.16, =0.1.0, =0.6.1, =0.1.0, =0.1.1, =0.1.122 - colpali-engine 0.3.10 - coqui-tts 0.26.2 - dadmatools 2.3.0 and more...

pytorch-clip-interrogator (>=2023.2.19.0, <=2023.2.19.1), stochasticx (>=0.0.14, <=0.0.19) +2 more potentially affected by CVE-2026-69112 via accelerate (0.14.0)

accelerate PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - pytorch-clip-interrogator =2023.2.19.0, =0.0.14, =0.1.0, =0.0.7, =0.0.9 Source cves: CVE-2026-69112 Source advisory: OSV:PYSEC-2026-3804...

allennlp (>=1.0.0rc6.dev20200604, <=1.1.0rc1.dev20200709), allennlp-models (>=1.0.0rc6, <=1.1.0rc1.dev20200709) +29 more potentially affected by CVE-2026-9856 via transformers (2.11.0)

transformers PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.0.0rc6.dev20200604, =1.0.0rc6, =0.0.1rc1, =0.1.2, =0.1.3, =0.5.2, =0.1.2, =3.0.1, =0.1.0, =1.8.0, =0.12.2.dev2, =0.12.2.dev...

cpkil (0.0.1), detoxify (0.5.1) +5 more potentially affected by CVE-2026-9856 via transformers (4.22.1)

transformers PYPI version 4.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - cpkil 0.0.1 - detoxify 0.5.1 - fmeval =0.2.0, =0.0.1, =0.1.0, =0.0.2, =0.0.7 Source cves: CVE-2026-9856 Source advisory:...

aaa-ml-datasets-course (1.0.0), adapters (>=0.2.0, <=0.2.1) +52 more potentially affected by CVE-2026-9856 via transformers (4.39.3)

transformers PYPI version 4.39.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aaa-ml-datasets-course 1.0.0 - adapters =0.2.0, =0.1.0, =0.7.44, =0.1.0, =0.2.1, =0.3.0, =0.1.0, =0.0.5, =0.0.1a0, =0.1.40a0, =0.1.43 -...

allennlp (>=1.0.0rc4.dev20200513, <=1.0.0rc6.dev20200601), allennlp-models (>=1.0.0rc4, <=1.0.0rc5) potentially affected by CVE-2026-9856 via transformers (2.9.1)

transformers PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.0.0rc4.dev20200513, =1.0.0rc4, =1.0.0rc5 Source cves: CVE-2026-9856 Source advisory: OSV:PYSEC-2026-3929...