🔒 Security Alerts — IBM/torchlogic

## 🔒 Security Alerts — IBM/torchlogic

> **Action required:** Remediate the alerts listed below before their SLA deadline.
> This issue will be closed automatically once all alerts are resolved.
>
> **SLA policy:** critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
> Alerts at or above medium severity will trigger a warning comment before the deadline and
> repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
> they will never trigger warnings or archiving.
>
> 💡 **Tip:** To have Dependabot automatically open fix PRs for dependency alerts, enable
> **Dependabot security updates** in your repo settings:
> Settings → Advanced Security → Dependabot security updates → Enable.
>
> 📖 **New to this issue?** See the [Security Issue Guide](https://ibm.github.io/security-ops-bot/security-issue-guide.html#what-you-should-do) for a full explanation of what this issue means and what you need to do.

Attention: @KyleErwin @estebandito22

### Dependabot Alerts

| Severity | CVE/GHSA | Package | Affected | Patched | Fix PR |
|---|---|---|---|---|---|
| 🟠 high | CVE-2026-54060 | pillow | < 12.3.0 | 12.3.0 | — |
| 🟠 high | CVE-2026-54058 | pillow | < 12.3.0 | 12.3.0 | — |
| 🟠 high | CVE-2026-54059 | pillow | < 12.3.0 | 12.3.0 | — |
| 🟠 high | CVE-2026-55380 | pillow | < 12.3.0 | 12.3.0 | — |
| 🟠 high | CVE-2026-55379 | pillow | < 12.3.0 | 12.3.0 | — |
| 🟠 high | CVE-2026-59197 | Pillow | < 12.3.0 | 12.3.0 | — |
| 🟠 high | CVE-2026-59199 | Pillow | < 12.3.0 | 12.3.0 | — |
| 🟠 high | CVE-2026-59205 | pillow | < 12.3.0 | 12.3.0 | — |
| 🟠 high | CVE-2026-59200 | Pillow | >= 5.1.0, < 12.3.0 | 12.3.0 | — |
| 🟠 high | CVE-2026-59204 | pillow | >= 8.2.0, < 12.3.0 | 12.3.0 | — |
| 🟡 medium | CVE-2025-2998 | torch | <= 2.6.0 | — | — |
| 🟡 medium | CVE-2025-2999 | torch | < 2.9.1 | 2.9.1 | — |
| 🟡 medium | CVE-2026-55798 | Pillow | < 12.3.0 | 12.3.0 | — |
| 🟡 medium | CVE-2026-59198 | Pillow | >= 5.2.0, < 12.3.0 | 12.3.0 | — |
| 🟡 medium | CVE-2026-59890 | setuptools | < 83.0.0 | 83.0.0 | — |
| 🔵 low | CVE-2025-2148 | torch | <= 2.6.0 | — | — |
| 🔵 low | CVE-2025-2149 | torch | <= 2.6.0 | — | — |
| 🔵 low | CVE-2025-3001 | torch | < 2.10.0 | 2.10.0 | — |
| 🔵 low | CVE-2026-10804 | streamlit | < 1.53.1 | 1.53.1 | — |
| 🔵 low | CVE-2025-3000 | torch | <= 2.12.1 | 2.13.0 | — |

### Code Scanning Alerts

_No open code scanning alerts._


### Secret Scanning Alerts

_No open secret scanning alerts._

---

Navigation Menu

Uh oh!

🔒 Security Alerts — IBM/torchlogic #7