🔒 Security Alerts — IBM/materials

## 🔒 Security Alerts — IBM/materials

> **Action required:** Remediate the alerts listed below before their SLA deadline.
> This issue will be closed automatically once all alerts are resolved.
>
> **SLA policy:** critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
> Alerts at or above medium severity will trigger a warning comment before the deadline and
> repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
> they will never trigger warnings or archiving.
>
> 💡 **Tip:** To have Dependabot automatically open fix PRs for dependency alerts, enable
> **Dependabot security updates** in your repo settings:
> Settings → Advanced Security → Dependabot security updates → Enable.
>
> 📖 **New to this issue?** See the [Security Issue Guide](https://ibm.github.io/security-ops-bot/security-issue-guide.html#what-you-should-do) for a full explanation of what this issue means and what you need to do.

Attention: @davebraines @emiliobrazil @indra-ipd @neumannrf

### Dependabot Alerts

| Severity | CVE/GHSA | Package | Affected | Patched | Fix PR |
|---|---|---|---|---|---|
| 🔴 critical | CVE-2025-32434 | torch | < 2.6.0 | 2.6.0 | — |
| 🔴 critical | CVE-2024-8769 | aim | >= 3.15.0, <= 3.27.0 | — | — |
| 🔴 critical | CVE-2026-31239 | mamba-ssm | <= 2.2.6 | — | — |
| 🟠 high | CVE-2024-11392 | transformers | >= 0, < 4.48.0 | 4.48.0 | — |
| 🟠 high | CVE-2024-11394 | transformers | >= 0, < 4.48.0 | 4.48.0 | — |
| 🟠 high | CVE-2024-11393 | transformers | >= 0, < 4.48.0 | 4.48.0 | — |
| 🟠 high | CVE-2024-31583 | torch | < 2.2.0 | 2.2.0 | — |
| 🟠 high | CVE-2024-31580 | torch | < 2.2.0 | 2.2.0 | — |
| 🟠 high | CVE-2026-40171 | notebook | >= 7.0.0, <= 7.5.5 | 7.5.6 | — |
| 🟠 high | CVE-2026-42557 | notebook | >= 7.0.0, <= 7.5.5 | 7.5.6 | — |
| 🟠 high | CVE-2026-31221 | pytorch-lightning | <= 2.6.0 | — | — |
| 🟠 high | CVE-2026-4372 | transformers | < 5.3.0 | 5.3.0 | — |
| 🟠 high | CVE-2026-5241 | transformers | < 5.5.0 | 5.5.0 | — |
| 🟠 high | CVE-2026-68508 | hydra-core | <= 1.3.3 | 1.3.4 | — |
| 🟠 high | CVE-2026-9856 | transformers | < 5.10.0 | 5.10.0 | — |
| 🟡 medium | CVE-2024-12720 | transformers | < 4.48.0 | 4.48.0 | — |
| 🟡 medium | CVE-2025-1194 | transformers | < 4.50.0 | 4.50.0 | — |
| 🟡 medium | CVE-2025-2099 | transformers | < 4.50.0 | 4.50.0 | — |
| 🟡 medium | CVE-2025-3730 | torch | <= 2.7.1 | 2.8.0 | — |
| 🟡 medium | CVE-2025-3263 | transformers | < 4.51.0 | 4.51.0 | — |
| 🟡 medium | CVE-2025-3264 | transformers | < 4.51.0 | 4.51.0 | — |
| 🟡 medium | CVE-2025-3933 | transformers | <= 4.51.3 | 4.52.1 | — |
| 🟡 medium | CVE-2025-5197 | transformers | < 4.53.0 | 4.53.0 | — |
| 🟡 medium | CVE-2025-51464 | aim | <= 3.30.0.dev20250611 | — | — |
| 🟡 medium | CVE-2025-6638 | transformers | < 4.53.0 | 4.53.0 | — |
| 🟡 medium | CVE-2025-6051 | transformers | < 4.53.0 | 4.53.0 | — |
| 🟡 medium | CVE-2025-6921 | transformers | < 4.53.0 | 4.53.0 | — |
| 🟡 medium | CVE-2024-5206 | scikit-learn | < 1.5.0 | 1.5.0 | — |
| 🟡 medium | CVE-2026-1839 | transformers | < 5.0.0rc3 | 5.0.0rc3 | — |
| 🟡 medium | CVE-2025-2998 | torch | <= 2.6.0 | — | — |
| 🟡 medium | CVE-2025-2999 | torch | < 2.9.1 | 2.9.1 | — |
| 🟡 medium | CVE-2026-59890 | setuptools | < 83.0.0 | 83.0.0 | — |
| 🟡 medium | CVE-2026-69112 | accelerate | <= 1.14.0 | — | — |
| 🔵 low | CVE-2025-2953 | torch | < 2.7.1-rc1 | 2.7.1-rc1 | — |
| 🔵 low | CVE-2025-3777 | transformers | < 4.52.1 | 4.52.1 | — |
| 🔵 low | CVE-2024-34062 | tqdm | >= 4.4.0, < 4.66.3 | 4.66.3 | — |
| 🔵 low | CVE-2025-5321 | aim | <= 3.29.1 | — | — |
| 🔵 low | CVE-2025-2148 | torch | <= 2.6.0 | — | — |
| 🔵 low | CVE-2025-2149 | torch | <= 2.6.0 | — | — |
| 🔵 low | CVE-2025-3001 | torch | < 2.10.0 | 2.10.0 | — |
| 🔵 low | CVE-2025-3000 | torch | <= 2.12.1 | 2.13.0 | — |

### Code Scanning Alerts

_No open code scanning alerts._


### Secret Scanning Alerts

_No open secret scanning alerts._

---

Navigation Menu

Uh oh!

🔒 Security Alerts — IBM/materials #72