GO-2026-5426 vulnerabilities

Vulnerabilities for packages: weaviate, jitsucom-bulker, kube-mgmt-fips, crossplane-provider-aws-cloudwatchlogs, rekor, crossplane-provider-aws-acm, datadog-agent-fips, crossplane-provider-aws-athena, cloudprober-fips, crossplane-provider-aws-efs, crossplane-provider-aws-vpc-fips,...

MAL-2026-11909 Malicious code in @servicetitan/notifications (npm)

npm/@servicetitan/notifications is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11832 Malicious code in @servicetitan/carto-charts-core (npm)

npm/@servicetitan/carto-charts-core is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11703 Malicious code in @or-sdk/key-value-storage (npm)

npm/@or-sdk/key-value-storage is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11815 Malicious code in @servicetitan/anvil-css-utilities (npm)

npm/@servicetitan/anvil-css-utilities is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...

Malicious code in @onereach/si-merge-tag-input (npm)

npm/@onereach/si-merge-tag-input is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A securit...

Linux Distros Unpatched Vulnerability : CVE-2026-47303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47303 Note that...

01os (>=0.0.5 <=0.0.13), airbyte-source-azure-blob-storage (>=0.3.3 <=0.6.12) +94 more potentially affected by CVE-2025-64712 via unstructured (>=0.10.10 <=0.18.15)

unstructured PYPI version =0.10.10, =0.0.5, =0.3.3, =0.3.6, =0.0.8, =0.1.5, =0.2.0, =4.5.1, =1.0.0, =0.0.1, =0.1.6, =0.2.2, =0.1.0, =0.1.16 - biorxivist =0.2.1 and more Source cves: CVE-2025-64712 Source advisory: OSV:PYSEC-2026-558...

a7a1234 (=1.0.0), aas2openapi (>=0.2.0 <=0.2.4) +2554 more potentially affected by CVE-2025-43859 via h11 (>=0.10.0 <=0.15.0)

h11 PYPI version =0.10.0, =0.2.0, =0.2.1, =1.2.1, =0.7.3.post0, =0.1.0, =2.0.0.1, =0.0.1, =0.1.0, =0.8.3, =0.1.0, =4.8.2, =0.1.0, =0.1.1 - adminui =1.5.2 and more Source cves: CVE-2025-43859 Source advisory: OSV:PYSEC-2026-348...

abdelrahman-obfuscate (>=1.0.0 <=1.0.1), abdo (=2.0.0) +181 more potentially affected by CVE-2026-48802 via python-engineio (>=3.10.0 <=4.13.1)

python-engineio PYPI version =3.10.0, =1.0.0, =2.0.0, =0.1.1, =0.1.1, =4.0.6, =0.16.0, =3.4.2, =0.9.0, =0.0.3, =4.0.2, =4.0.0.8, =0.0.1, =0.1.0b1 and more Source cves: CVE-2026-48802 Source advisory: OSV:GHSA-CGWC-PV48-FHJ5...

appyter (>=0.16.0 <=0.20.2), aprsd (>=3.4.2 <=3.4.4) +27 more potentially affected by CVE-2026-48802 via python-engineio (>=4.0.0 <=4.13.1)

python-engineio PYPI version =4.0.0, =0.16.0, =3.4.2, =0.50.1, =1.0.1, =0.4.4, =0.11.0, =0.0.1, =1.0.9, =6.0.44, =0.0.6, =0.2.2, =0.1.0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-48802 Source advisory: SNYK:PYTHON-PYTHONENGINEIO-17660884...

appyter (>=0.16.0 <=0.20.2), aprsd (>=3.4.2 <=3.4.4) +27 more potentially affected by CVE-2026-48809 via python-engineio (>=4.0.0 <=4.13.1)

python-engineio PYPI version =4.0.0, =0.16.0, =3.4.2, =0.50.1, =1.0.1, =0.4.4, =0.11.0, =0.0.1, =1.0.9, =6.0.44, =0.0.6, =0.2.2, =0.1.0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-48809 Source advisory: SNYK:PYTHON-PYTHONENGINEIO-17660885...

@10xsai/cloudflare-router-nx-plugin (=1.0.0), @abelfubu/schematics (=0.1.1) +629 more potentially affected by CVE-2026-54753 via nx (>=17.0.4 <=22.7.1)

nx NPM version =17.0.4, =0.1.5, =0.0.3, =0.0.47, =0.0.1, =17.0.2-alpha.2, =17.0.2-alpha.2, =8.1.1, =0.0.1, =0.0.1, =0.0.15 and more Source cves: CVE-2026-54753 Source advisory: SNYK:JS-NX-17660796...

elemeno-ai-sdk (>=0.0.77 <=0.6.11), elemeno-mlops-cli (>=0.0.1 <=0.0.4) +22 more potentially affected by CVE-2026-56121 via feast (>=0.14.1 <=0.49.0)

feast PYPI version =0.14.1, =0.0.77, =0.0.1, =0.1.0, =0.3.0, =0.0.2, =1.0.0, =0.1.0, =0.1.33, =0.1.0, =0.6.19 and more Source cves: CVE-2026-56121 Source advisory: SNYK:PYTHON-FEAST-17458831...

ai.abkr.open:any (>=1.0.6 <=1.0.22), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +6931 more potentially affected by CVE-2026-54517 via tools.jackson.core:jackson-databind (>=3.0.0-rc1 <=3.1.3)

tools.jackson.core:jackson-databind MAVEN version =3.0.0-rc1, =1.0.6, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.2, =0.1.0, =0.1.0, =0.3.0 and more Source cves...

ai.abkr.open:any (>=1.0.6 <=1.0.22), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +6910 more potentially affected by CVE-2026-54516 via tools.jackson.core:jackson-databind (>=3.0.0 <=3.1.3)

tools.jackson.core:jackson-databind MAVEN version =3.0.0, =1.0.6, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.2, =0.1.0, =0.1.0, =0.3.0 and more Source cves:...

ai.abkr.open:any (>=1.0.6 <=1.0.22), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +6910 more potentially affected by CVE-2026-54514 via tools.jackson.core:jackson-databind (>=3.0.0 <=3.1.3)

tools.jackson.core:jackson-databind MAVEN version =3.0.0, =1.0.6, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.2, =0.1.0, =0.1.0, =0.3.0 and more Source cves:...

ai.abkr.open:any (>=1.0.6 <=1.0.22), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +6931 more potentially affected by CVE-2026-54518 via tools.jackson.core:jackson-databind (>=3.0.0-rc1 <=3.1.3)

tools.jackson.core:jackson-databind MAVEN version =3.0.0-rc1, =1.0.6, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.2, =0.1.0, =0.1.0, =0.3.0 and more Source cves...

@bloggrify/bento (>=3.0.0 <=3.0.1), @bloggrify/core (>=3.0.0 <=3.1.2) +22 more potentially affected by CVE-2026-56698 via nuxt (>=4.0.0-rc.0 <=4.4.6)

nuxt NPM version =4.0.0-rc.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =10.0.2, =1.1.11, =1.0.4, =0.4.5, =0.0.0, =0.0.1, =1.0.0, =1.1.0, =2.0.1 and more Source cves: CVE-2026-56698 Source advisory: SNYK:JS-NUXT-17430978...