🔒 [IBM OSPO Security Notification] — IBM/materials

[security-ops-bot]

🔒 [IBM OSPO Security Notification] — IBM/materials

Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.

SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.

💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.

📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.

Attention: @davebraines @emiliobrazil @indra-ipd @neumannrf

Dependabot Alerts

Severity	CVE/GHSA	Package	Affected	Patched	Deadline	Fix PR
🟠 high	CVE-2026-40171	notebook	>= 7.0.0, <= 7.5.5	7.5.6	2026-10-23	—
🟠 high	CVE-2026-42557	notebook	>= 7.0.0, <= 7.5.5	7.5.6	2026-10-23	—
🟠 high	CVE-2026-4372	transformers	< 5.3.0	5.3.0	2026-10-21	—
🟠 high	CVE-2026-5241	transformers	< 5.5.0	5.5.0	2026-10-21	—
🟠 high	CVE-2026-68508	hydra-core	<= 1.3.3	1.3.4	2026-10-10	—
🟠 high	CVE-2026-9856	transformers	< 5.10.0	5.10.0	2026-10-10	—
🟡 medium	CVE-2026-1839	transformers	< 5.0.0rc3	5.0.0rc3	2026-12-22	—
🟡 medium	CVE-2025-2998	torch	<= 2.6.0	—	2026-12-22	—
🟡 medium	CVE-2025-2999	torch	< 2.9.1	2.9.1	2026-12-22	—
🟡 medium	CVE-2026-59890	setuptools	< 83.0.0	83.0.0	2026-12-20	—
🟡 medium	CVE-2026-69112	accelerate	<= 1.14.0	—	2026-12-09	—
🔵 low	CVE-2025-2148	torch	<= 2.6.0	—	—	—
🔵 low	CVE-2025-2149	torch	<= 2.6.0	—	—	—
🔵 low	CVE-2025-3001	torch	< 2.10.0	2.10.0	—	—
🔵 low	CVE-2025-3000	torch	<= 2.12.1	2.13.0	—	—

Code Scanning Alerts

No open code scanning alerts.

Secret Scanning Alerts

No open secret scanning alerts.

---

[security-ops-bot]

🔄 Dependabot Alert Changes

Resolved: CVE-2024-11392, CVE-2024-11394, CVE-2024-11393, CVE-2024-12720, CVE-2025-1194, CVE-2025-2099, CVE-2025-3263, CVE-2025-3264, CVE-2025-3777, CVE-2025-3933

[security-ops-bot]

🔄 Dependabot Alert Changes

Resolved: CVE-2025-5197, CVE-2024-34062, CVE-2025-2953, CVE-2025-5321, CVE-2025-3730, CVE-2025-51464, CVE-2025-32434, CVE-2025-6638, CVE-2025-6051, CVE-2025-6921, CVE-2024-31583, CVE-2024-31580, CVE-2024-8769, CVE-2024-5206

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2024-11392 (high), CVE-2024-11394 (high), CVE-2024-11393 (high), CVE-2024-12720 (medium), CVE-2025-1194 (medium), CVE-2025-2099 (medium), CVE-2025-2953 (low), CVE-2025-3730 (medium), CVE-2025-3263 (medium), CVE-2025-3264 (medium), CVE-2025-3777 (low), CVE-2025-3933 (medium), CVE-2025-5197 (medium), CVE-2024-34062 (low), CVE-2025-5321 (low), CVE-2025-51464 (medium), CVE-2025-32434 (critical), CVE-2025-6638 (medium), CVE-2025-6051 (medium), CVE-2025-6921 (medium), CVE-2024-31583 (high), CVE-2024-31580 (high), CVE-2024-8769 (critical), CVE-2024-5206 (medium)

[security-ops-bot]

⚠️ SLA Warning — IBM/materials

The following alert is approaching their SLA deadline with 3 days remaining. Please remediate before the deadline to avoid automatic repository archiving.

To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g. #CVE-XXXX-YYYY) in the PR title.

Alert	Severity	Deadline
CVE-2026-31239	critical	2026-09-17

@davebraines @emiliobrazil @indra-ipd @neumannrf

[security-ops-bot]

⚠️ SLA Warning — IBM/materials

The following alert is approaching their SLA deadline with 1 day remaining. Please remediate before the deadline to avoid automatic repository archiving.

To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g. #CVE-XXXX-YYYY) in the PR title.

Alert	Severity	Deadline
CVE-2026-31239	critical	2026-09-17

@davebraines @emiliobrazil @indra-ipd @neumannrf

[security-ops-bot]

🔄 Dependabot Alert Changes

Resolved: CVE-2024-5206, CVE-2026-31221, CVE-2026-31239

[security-ops-bot]

⚠️ SLA Warning — IBM/materials

The following 2 alerts are approaching their SLA deadline with 3 days remaining. Please remediate before the deadline to avoid automatic repository archiving.

To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g. #CVE-XXXX-YYYY) in the PR title.

Alert	Severity	Deadline
CVE-2025-32434	critical	2026-09-20
CVE-2024-8769	critical	2026-09-20

@davebraines @emiliobrazil @indra-ipd @neumannrf

[security-ops-bot]

🔄 Dependabot Alert Changes

Resolved: CVE-2024-11392, CVE-2024-11394, CVE-2024-11393, CVE-2024-12720, CVE-2025-1194, CVE-2025-2099, CVE-2025-2953, CVE-2025-3730, CVE-2025-3263, CVE-2025-3264, CVE-2025-3777, CVE-2025-3933, CVE-2025-5197, CVE-2024-34062, CVE-2025-5321, CVE-2025-51464, CVE-2025-32434, CVE-2025-6638, CVE-2025-6051, CVE-2025-6921, CVE-2024-31583, CVE-2024-31580, CVE-2024-8769

[security-ops-bot]

🔄 Dependabot Alert Changes

Resolved: CVE-2026-1839, CVE-2026-40171, CVE-2026-42557, CVE-2025-2148, CVE-2025-2998, CVE-2025-2149, CVE-2025-2999, CVE-2025-3001, CVE-2026-4372, CVE-2026-5241, CVE-2025-3000, CVE-2026-59890

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2026-4372 (high), CVE-2026-5241 (high), CVE-2025-3000 (low), CVE-2026-59890 (medium)

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2026-1839 (medium), CVE-2026-40171 (high), CVE-2026-42557 (high), CVE-2025-2148 (low), CVE-2025-2998 (medium), CVE-2025-2149 (low), CVE-2025-2999 (medium), CVE-2025-3001 (low)