# Advisories

> Security advisories and CVEs in the AI and data stack (vLLM, Ollama, LangChain, PyTorch, MLflow, Airflow, Spark and 63 more projects): severity, CVSS score, affected and fixed versions, each linked to its source.

Advisories (advisories.fru.dev) holds 2669 advisories (342 critical, 1013 high, 1048 medium, 234 low, 32 unrated; latest published 2026-09-23). Each record has the GitHub advisory id (GHSA, or the OSV id when GitHub has none), the CVE and other aliases, the affected project and packages (PyPI, npm, Maven, Go), severity and CVSS score, affected version ranges and the version that fixes it, published and modified dates, a summary and the references. Data comes from the OSV API (which carries the GitHub Advisory Database) every day at 07:15 UTC; NVD fills in scores for a few records a run. CVSS 3.x scores are computed from the vector; severity labels are GitHub's where it reviewed the advisory. Nothing is deleted: withdrawn advisories are marked, and every change to severity, score, summary or fixed versions is logged (see /changes).

Last successful refresh: 2026-09-25 11:20:15 UTC (297 new). Last run: 2026-09-25 11:20:15 UTC, ok. Next scheduled run: daily at 07:15 UTC.

## About this data

Advisories from OSV and the GitHub Advisory Database, checked every day, with NVD scores where they lack one; withdrawn ones are marked. Severity and versions are as each advisory states them, so check the source before you act; this is not a security audit. The list grows as new advisories are published. Logos via logo.dev; trademarks belong to their owners.

## Pages

- [Patch now](https://advisories.fru.dev/): critical and high advisories of the last weeks, then the latest
- [All advisories](https://advisories.fru.dev/advisories): filter by package, severity, ecosystem and period
- [Packages](https://advisories.fru.dev/packages): every project covered
- [Critical](https://advisories.fru.dev/severity/critical), [High](https://advisories.fru.dev/severity/high), [Medium](https://advisories.fru.dev/severity/medium), [Low](https://advisories.fru.dev/severity/low)
- [Changes](https://advisories.fru.dev/changes): severity, score, summary and fixed-version changes as they happen
- [TensorFlow security advisories](https://advisories.fru.dev/packages/tensorflow): 433 advisories, 0 critical or high in 12 months
- [Open WebUI security advisories](https://advisories.fru.dev/packages/open-webui): 161 advisories, 65 critical or high in 12 months
- [n8n security advisories](https://advisories.fru.dev/packages/n8n): 156 advisories, 79 critical or high in 12 months
- [Apache Airflow security advisories](https://advisories.fru.dev/packages/airflow): 151 advisories, 21 critical or high in 12 months
- [Flowise security advisories](https://advisories.fru.dev/packages/flowise): 112 advisories, 71 critical or high in 12 months
- [MLflow security advisories](https://advisories.fru.dev/packages/mlflow): 82 advisories, 24 critical or high in 12 months
- [vLLM security advisories](https://advisories.fru.dev/packages/vllm): 71 advisories, 18 critical or high in 12 months
- [Apache Superset security advisories](https://advisories.fru.dev/packages/superset): 66 advisories, 2 critical or high in 12 months
- [Jupyter security advisories](https://advisories.fru.dev/packages/jupyter): 55 advisories, 11 critical or high in 12 months
- [NLTK security advisories](https://advisories.fru.dev/packages/nltk): 52 advisories, 32 critical or high in 12 months
- [Gradio security advisories](https://advisories.fru.dev/packages/gradio): 52 advisories, 4 critical or high in 12 months
- [LangChain security advisories](https://advisories.fru.dev/packages/langchain): 45 advisories, 6 critical or high in 12 months
- [Elasticsearch security advisories](https://advisories.fru.dev/packages/elasticsearch): 43 advisories, 0 critical or high in 12 months
- [LiteLLM security advisories](https://advisories.fru.dev/packages/litellm): 42 advisories, 13 critical or high in 12 months
- [Langflow security advisories](https://advisories.fru.dev/packages/langflow): 32 advisories, 20 critical or high in 12 months
- [PaddlePaddle security advisories](https://advisories.fru.dev/packages/paddlepaddle): 32 advisories, 0 critical or high in 12 months
- [PyTorch security advisories](https://advisories.fru.dev/packages/pytorch): 31 advisories, 8 critical or high in 12 months
- [Transformers security advisories](https://advisories.fru.dev/packages/transformers): 31 advisories, 11 critical or high in 12 months
- [Apache Solr security advisories](https://advisories.fru.dev/packages/solr): 31 advisories, 3 critical or high in 12 months
- [LlamaIndex security advisories](https://advisories.fru.dev/packages/llamaindex): 27 advisories, 4 critical or high in 12 months
- [MindsDB security advisories](https://advisories.fru.dev/packages/mindsdb): 23 advisories, 2 critical or high in 12 months
- [Keras security advisories](https://advisories.fru.dev/packages/keras): 20 advisories, 8 critical or high in 12 months
- [BentoML security advisories](https://advisories.fru.dev/packages/bentoml): 17 advisories, 8 critical or high in 12 months
- [H2O-3 security advisories](https://advisories.fru.dev/packages/h2o): 17 advisories, 2 critical or high in 12 months
- [Ollama security advisories](https://advisories.fru.dev/packages/ollama): 16 advisories, 2 critical or high in 12 months
- [MinIO security advisories](https://advisories.fru.dev/packages/minio): 15 advisories, 7 critical or high in 12 months
- [ZenML security advisories](https://advisories.fru.dev/packages/zenml): 14 advisories, 0 critical or high in 12 months
- [ONNX security advisories](https://advisories.fru.dev/packages/onnx): 13 advisories, 4 critical or high in 12 months
- [Apache Spark security advisories](https://advisories.fru.dev/packages/spark): 13 advisories, 1 critical or high in 12 months
- [Label Studio security advisories](https://advisories.fru.dev/packages/label-studio): 12 advisories, 1 critical or high in 12 months
- [Apache Hadoop security advisories](https://advisories.fru.dev/packages/hadoop): 12 advisories, 0 critical or high in 12 months
- [Ray security advisories](https://advisories.fru.dev/packages/ray): 11 advisories, 5 critical or high in 12 months
- [SGLang security advisories](https://advisories.fru.dev/packages/sglang): 10 advisories, 6 critical or high in 12 months
- [LMDeploy security advisories](https://advisories.fru.dev/packages/lmdeploy): 10 advisories, 8 critical or high in 12 months
- [Apache Kafka security advisories](https://advisories.fru.dev/packages/kafka): 10 advisories, 2 critical or high in 12 months
- [Apache Hive security advisories](https://advisories.fru.dev/packages/hive): 10 advisories, 0 critical or high in 12 months
- [MCP SDKs security advisories](https://advisories.fru.dev/packages/mcp-sdk): 9 advisories, 7 critical or high in 12 months
- [Apache ZooKeeper security advisories](https://advisories.fru.dev/packages/zookeeper): 9 advisories, 2 critical or high in 12 months
- [NumPy security advisories](https://advisories.fru.dev/packages/numpy): 8 advisories, 0 critical or high in 12 months
- [IPython security advisories](https://advisories.fru.dev/packages/ipython): 8 advisories, 0 critical or high in 12 months
- [Prefect security advisories](https://advisories.fru.dev/packages/prefect): 8 advisories, 2 critical or high in 12 months
- [TorchServe security advisories](https://advisories.fru.dev/packages/torchserve): 6 advisories, 0 critical or high in 12 months
- [Streamlit security advisories](https://advisories.fru.dev/packages/streamlit): 6 advisories, 0 critical or high in 12 months
- [Apache Arrow security advisories](https://advisories.fru.dev/packages/arrow): 5 advisories, 1 critical or high in 12 months
- [Vanna security advisories](https://advisories.fru.dev/packages/vanna): 4 advisories, 0 critical or high in 12 months
- [PandasAI security advisories](https://advisories.fru.dev/packages/pandasai): 4 advisories, 0 critical or high in 12 months
- [Chroma security advisories](https://advisories.fru.dev/packages/chroma): 4 advisories, 4 critical or high in 12 months
- [Weaviate security advisories](https://advisories.fru.dev/packages/weaviate): 4 advisories, 2 critical or high in 12 months
- [ClearML security advisories](https://advisories.fru.dev/packages/clearml): 4 advisories, 0 critical or high in 12 months
- [Kedro security advisories](https://advisories.fru.dev/packages/kedro): 4 advisories, 2 critical or high in 12 months
- [dbt Core security advisories](https://advisories.fru.dev/packages/dbt): 4 advisories, 0 critical or high in 12 months
- [Milvus security advisories](https://advisories.fru.dev/packages/milvus): 3 advisories, 2 critical or high in 12 months
- [scikit-learn security advisories](https://advisories.fru.dev/packages/scikit-learn): 3 advisories, 0 critical or high in 12 months
- [Dagster security advisories](https://advisories.fru.dev/packages/dagster): 3 advisories, 1 critical or high in 12 months
- [DuckDB security advisories](https://advisories.fru.dev/packages/duckdb): 3 advisories, 0 critical or high in 12 months
- [Xinference security advisories](https://advisories.fru.dev/packages/xinference): 2 advisories, 1 critical or high in 12 months
- [LangGraph security advisories](https://advisories.fru.dev/packages/langgraph): 2 advisories, 1 critical or high in 12 months
- [Haystack security advisories](https://advisories.fru.dev/packages/haystack): 2 advisories, 0 critical or high in 12 months
- [Semantic Kernel security advisories](https://advisories.fru.dev/packages/semantic-kernel): 2 advisories, 2 critical or high in 12 months
- [Llama Stack security advisories](https://advisories.fru.dev/packages/llama-stack): 2 advisories, 0 critical or high in 12 months
- [Feast security advisories](https://advisories.fru.dev/packages/feast): 2 advisories, 1 critical or high in 12 months
- [Apache Parquet security advisories](https://advisories.fru.dev/packages/parquet): 2 advisories, 0 critical or high in 12 months
- [Apache Avro security advisories](https://advisories.fru.dev/packages/avro): 2 advisories, 0 critical or high in 12 months
- [llama-cpp-python security advisories](https://advisories.fru.dev/packages/llama-cpp-python): 1 advisories, 0 critical or high in 12 months
- [DeepSpeed security advisories](https://advisories.fru.dev/packages/deepspeed): 1 advisories, 0 critical or high in 12 months
- [pandas security advisories](https://advisories.fru.dev/packages/pandas): 1 advisories, 0 critical or high in 12 months
- [joblib security advisories](https://advisories.fru.dev/packages/joblib): 1 advisories, 0 critical or high in 12 months
- [MLRun security advisories](https://advisories.fru.dev/packages/mlrun): 1 advisories, 0 critical or high in 12 months
- [Apache Flink security advisories](https://advisories.fru.dev/packages/flink): 1 advisories, 0 critical or high in 12 months
- [OpenSearch security advisories](https://advisories.fru.dev/packages/opensearch): 1 advisories, 0 critical or high in 12 months

## Data

- [Sitemap](https://advisories.fru.dev/sitemap.xml)
- [RSS, all advisories](https://advisories.fru.dev/rss.xml); critical and high only: https://advisories.fru.dev/severe.xml; per package: https://advisories.fru.dev/packages/<id>/rss.xml
- [Full plain-text dump](https://advisories.fru.dev/llms-full.txt): one line per advisory
- JSON API, any page's data: https://advisories.fru.dev/api/page?path=/packages/<id>

## API

- [For AI agents](https://advisories.fru.dev/agents): how to use this data in an agent (system prompt line, tool definition, code)
- [OpenAPI 3.1 spec](https://advisories.fru.dev/openapi.json): the public read endpoints below, ready to load as tools
- [GET /api/advisories](https://advisories.fru.dev/api/advisories?product=vllm&severity=critical&limit=2): Advisories, newest first, filtered by package, severity, ecosystem, period or words; returns advisories with id (GHSA), CVE and aliases, summary, severity, CVSS score, package, fixed versions, dates and the source URL, plus the total
- [GET /api/advisories/{id}](https://advisories.fru.dev/api/advisories/GHSA-2pc9-4j83-qjmr): One advisory in full: affected version ranges per package, CVSS vector, CWEs, references and its change history; returns the advisory and up to 6 related advisories of the same package
- [GET /api/packages](https://advisories.fru.dev/api/packages?limit=2): Every project covered, most advisories first; returns packages with id, name, category, the ecosystem packages, advisory counts, latest date, GitHub repo and company
- [GET /api/companies](https://advisories.fru.dev/api/companies?limit=2): Companies behind the projects; with since, the registry feed of companies with new advisories; returns companies with slug (companies.fru.dev), name, domain, projects and advisory count; with since: slug, name, domain, url, projects, advisories, updated_at and items (date, type, severity, score, title, id, cve, url, source_url)
- [GET /api/changes](https://advisories.fru.dev/api/changes?limit=2): Changes to advisories after they were first listed: severity, score, summary, fixed versions, withdrawals; returns changes with advisory id, field, old and new value, time and source URL, newest first
- [GET /api/search](https://advisories.fru.dev/api/search?q=langchain&limit=3): Search packages, advisories, CVE ids and pages; returns up to 20 ranked results with title, link and one line

Free to read. Cite "Advisories (advisories.fru.dev)" with a link. Responses are cached at the edge; keep to about 60 requests a minute.