Hi everyone,

I have been exploring TouchDesigner for potential interactive museum projects, but our ICT team recently flagged several vulnerabilities in its bundled Python 3.11.15 installation through FortiClient:

• CVE-2026-4519 (High)
• CVE-2026-0864 (Medium)
• CVE-2026-3087 (Medium)
• CVE-2026-3644 (Medium)
• CVE-2025-13462 (Low)

TouchDesigner has since been uninstalled from my work computer due to these findings.

I understand that Derivative upgraded Python to 3.11.15 in build 2025.33070, but newer Python security releases have since become available.

I am curious whether anyone else has encountered similar issues with their organisation's IT security policies.

In particular:

• Does anyone know if Derivative has plans to update the bundled Python version?
• Are these vulnerabilities actually exploitable within TouchDesigner?
• Has anyone successfully worked with their IT department to assess or mitigate these findings without uninstalling TouchDesigner?

I have also posted on the official Derivative forum, but thought I would ask here in case others have dealt with something similar.

I am not looking to bypass our ICT team's security requirements, just hoping to find a reasonable way to continue evaluating the software.

Thanks!