Which AI libraries does it detect?

Model runtimes (transformers, torch, tensorflow, onnxruntime, vllm, llama-cpp), LLM SDKs (openai, anthropic, cohere, litellm, google-generativeai), agent/orchestration frameworks (langchain, langgraph, llama-index, langflow, crewai, autogen, semantic-kernel, haystack), vector databases (chromadb, pinecone, weaviate, qdrant, faiss, milvus), and MCP libraries.

Why does it flag some dependencies as risky?

Several AI frameworks have had recent, actively-exploited vulnerabilities — for example Langflow (CVE-2026-0768), LiteLLM (CVE-2026-59822) and Hugging Face Transformers (CVE-2026-80047). The scanner flags those so you can verify your version is patched.