ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.1.3), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.0.3, <=6.1.3) +68 more potentially affected by CVE-2026-33180 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.6.36)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.6.36 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =6.0.0, =6.0.3, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.7.0, <=5.7.9), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.7.7, <=5.7.9) +48 more potentially affected by CVE-2026-33180 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (5.6.27)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version 5.6.27 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4b and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.7.0, =5.7.7, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.2.0, <=6.2.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.2.0, <=6.2.5) +84 more potentially affected by CVE-2026-33180 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.6.68)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.6.68 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=3.4.0, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.4.2, <=6.4.7) +72 more potentially affected by CVE-2026-33180 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.6.971)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.6.971 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =3.4.0, =6.4.2, =6.4.2, =6.4.2, =6.4.2, =6.4.2, =6.4.2,...

dyad (0.1.1), dyad-app (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-33057 via mesop (1.0.0rc1)

mesop PYPI version 1.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on mesop and may be impacted: - dyad 0.1.1 - dyad-app =0.1.0, =0.1.2 Source cves: CVE-2026-33057 Source advisory: OSV:GHSA-GJGX-RVQR-6W6V...

dyad (0.1.1), dyad-app (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-33057 via mesop (1.0.0rc1)

mesop PYPI version 1.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on mesop and may be impacted: - dyad 0.1.1 - dyad-app =0.1.0, =0.1.2 Source cves: CVE-2026-33057 Source advisory: GHSA-GJGX-RVQR-6W6V...

dyad (0.1.1), dyad-app (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-33054 via mesop (1.0.0rc1)

mesop PYPI version 1.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on mesop and may be impacted: - dyad 0.1.1 - dyad-app =0.1.0, =0.1.2 Source cves: CVE-2026-33054 Source advisory: GHSA-8QVF-MR4W-9X2C...

dyad (0.1.1), dyad-app (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-33054 via mesop (1.0.0rc1)

mesop PYPI version 1.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on mesop and may be impacted: - dyad 0.1.1 - dyad-app =0.1.0, =0.1.2 Source cves: CVE-2026-33054 Source advisory: OSV:GHSA-8QVF-MR4W-9X2C...

web-app-security-project

🛡️ Web Application Security Project 📌 Overview This projec...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to arbitrary code execution (GHSA-5c6j-r48x-rmvq)

Summary Node.js module serialize-javascript is used by IBM App Connect Enterprise Certified Container DesignerAuthoring operands. DesignerAuthoring operands are vulnerable to arbitrary code execution. This bulletin provides patch information to address the reported vulnerability in Node.js module...

CVE-2026-32694

In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the...

Malicious code in signer-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b301c6e6ca05f396b336ffb3bf41042d7ea226645dc1f455ca12e7f6ff04f01 The package signer-app was found to contain malicious code...

MAL-2026-1847 Malicious code in signer-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b301c6e6ca05f396b336ffb3bf41042d7ea226645dc1f455ca12e7f6ff04f01 The package signer-app was found to contain malicious code...

Malicious code in proleis-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd065de5d26ebde43c9fef2003ea3ffbc21bfa47120965cf1c6a893da876d33 The package proleis-web-app was found to contain malicious code...

MAL-2026-1825 Malicious code in proleis-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd065de5d26ebde43c9fef2003ea3ffbc21bfa47120965cf1c6a893da876d33 The package proleis-web-app was found to contain malicious code...

CVE-2026-32694 Insecure Direct Object Reference attack via predictable secret ID in Juju

In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the...

MAL-2026-1596 Malicious code in @emerald-react/app-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1bef759f7319b0aca58864ce4ec92e4c9b2ac5a5fc166d8c4b5b755e9e2128 The package @emerald-react/app-header was found to contain malicious code...

Malicious code in @emerald-react/app-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1bef759f7319b0aca58864ce4ec92e4c9b2ac5a5fc166d8c4b5b755e9e2128 The package @emerald-react/app-header was found to contain malicious code...

Meta’s AI Glasses and Privacy

Surprising no one, Meta's new AI glasses are a privacy disaster. I'm not sure what can be done here. This is a technology that will exist, whether we like it or not. Meanwhile, there is a new Android app that detects when there are smart glasses nearby...

CVE-2026-27979

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the next-resume: 1 header corresponding with a PPR resume request would buffer request bodies without consistently enforcing maxPostponedStateSize in...