io.camunda:camunda-zeebe (>=8.9.0-alpha5-rc1, <=8.9.0-alpha5), io.camunda:tasklist-webapp (>=8.9.0-alpha5-rc1, <=8.9.0-alpha5) +15 more potentially affected by CVE-2026-94398 via org.elasticsearch:elasticsearch (>=8.12.0, <=8.19.21)

org.elasticsearch:elasticsearch MAVEN version =8.12.0, =8.9.0-alpha5-rc1, =8.9.0-alpha5-rc1, =main-272, =main-272, =main-272, =0.87.0, =7.25.0, =8.12.0.0, =8.12.0.0, =8.12.0.0, =8.12.0.0, =8.12.0, =8.12.0, =2.1, =3.0.0 - org.opennms.elasticsearch:elasticsearch-drift-plugin-8.18.2 2.0.7 and more...

io.zerows:zero-boot-actor (1.0.50), io.zerows:zero-boot-cloud-actor (1.0.50) +17 more potentially affected by CVE-2026-82294 via org.elasticsearch:elasticsearch (>=9.0.0, <=9.4.5)

org.elasticsearch:elasticsearch MAVEN version =9.0.0, =0.102.0, =9.4.0, =9.4.0, =9.0.0, =9.4.5 and more Source cves: CVE-2026-82294 Source advisory: MEND:CVE-2026-82294...

CVE-2026-100668

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...

aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +133 more potentially affected by CVE-2026-100650 via vllm (>=0.1.3, <=0.29.0)

vllm PYPI version =0.1.3, =0.2.1, =1.2.2, =2.3.5.dev0, =0.0.1b1, =0.2.2, =0.2.4, =0.1.0, =0.1.15rc1, =0.1.0, =0.1.0, =0.2.1 and more Source cves: CVE-2026-100650 Source advisory: OSV:PYSEC-2026-4184...

0.extends.fc (1.0.65), 0.extends.react (1.0.51) +13377 more potentially affected by CVE-2026-100700 via nodemailer (>=0.1.5, <=10.0.3)

nodemailer NPM version =0.1.5, =1.0.49, =1.0.1, =1.0.0, =1.0.0, =0.2.9, =0.2.19 and more Source cves: CVE-2026-100700 Source advisory: MEND:CVE-2026-100700...

@bigegg/parse-server-schema-config (>=1.0.5, <=1.0.10), @kontaa/subgraph (>=1.0.1, <=1.2.3) +27 more potentially affected by CVE-2026-100631 via parse-server (>=2.0.8, <=7.5.4)

parse-server NPM version =2.0.8, =1.0.5, =1.0.1, =1.2.1, =2.4.46, =2.4.8, =1.0.0, =1.0.0, =1.0.1, =0.1.1, =0.0.2, =1.0.0, =0.1.0, =0.1.7, =0.0.1, =0.0.29 - parse-cli-server2 0.0.30 and more Source cves: CVE-2026-100631 Source advisory: MEND:CVE-2026-100631...

@0xwork/connect (>=0.1.8, <=0.1.9), @chrysb/alphaclaw (>=0.8.7, <=0.9.34) +13 more potentially affected by CVE-2026-100547 via openclaw (>=2026.4.5, <=2026.7.1)

openclaw NPM version =2026.4.5, =0.1.8, =0.8.7, =2.2.4, =4.0.0, =0.2.5, =1.1.50, =2.1.8, =0.1.0, =0.0.1-release20260506, =0.1.38, =0.3.1-next.0, =1.0.0, =1.3.1 Source cves: CVE-2026-100547 Source advisory: SNYK:JS-OPENCLAW-20186829...

@0xwork/connect (>=0.1.8, <=0.1.9), @chrysb/alphaclaw (>=0.8.7, <=0.9.34) +13 more potentially affected by CVE-2026-100549 via openclaw (>=2026.4.5, <=2026.7.1)

openclaw NPM version =2026.4.5, =0.1.8, =0.8.7, =2.2.4, =4.0.0, =0.2.5, =1.1.50, =2.1.8, =0.1.0, =0.0.1-release20260506, =0.1.38, =0.3.1-next.0, =1.0.0, =1.3.1 Source cves: CVE-2026-100549 Source advisory: SNYK:JS-OPENCLAW-20186827...

@0xwork/connect (>=0.1.8, <=0.1.9), @chrysb/alphaclaw (>=0.8.7, <=0.9.34) +14 more potentially affected by CVE-2026-100574 via openclaw (>=0.0.1, <=2026.7.1)

openclaw NPM version =0.0.1, =0.1.8, =0.8.7, =2.2.4, =4.0.0, =0.2.5, =1.1.50, =2.1.8, =0.1.0, =0.0.1-release20260506, =0.1.38, =0.3.1-next.0, =1.0.0, =1.3.1 and more Source cves: CVE-2026-100574 Source advisory: MEND:CVE-2026-100574...

@0xwork/connect (>=0.1.8, <=0.1.9), @chrysb/alphaclaw (>=0.8.7, <=0.9.34) +14 more potentially affected by CVE-2026-100573 via openclaw (>=0.0.1, <=2026.7.1)

openclaw NPM version =0.0.1, =0.1.8, =0.8.7, =2.2.4, =4.0.0, =0.2.5, =1.1.50, =2.1.8, =0.1.0, =0.0.1-release20260506, =0.1.38, =0.3.1-next.0, =1.0.0, =1.3.1 and more Source cves: CVE-2026-100573 Source advisory: MEND:CVE-2026-100573...

@0xwork/connect (>=0.1.8, <=0.1.9), @chrysb/alphaclaw (>=0.8.7, <=0.9.34) +13 more potentially affected by CVE-2026-100535 via openclaw (>=2026.4.5, <=2026.7.1)

openclaw NPM version =2026.4.5, =0.1.8, =0.8.7, =2.2.4, =4.0.0, =0.2.5, =1.1.50, =2.1.8, =0.1.0, =0.0.1-release20260506, =0.1.38, =0.3.1-next.0, =1.0.0, =1.3.1 Source cves: CVE-2026-100535 Source advisory: MEND:CVE-2026-100535...

SUSE CVE-2026-93252

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2initacl A lockdep warning indicates a circular locking dependency between &oi-ipxattrsem and &journal-jtransbarrier: WARNING: possible circular locking dependency detected is trying ...

fr.enedis.chutney:action-impl (5.0.0), fr.enedis.chutney:chutney-kotlin-dsl (5.0.0) +6 more potentially affected by CVE-2026-92564 via org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol (>=10.0.0, <=10.1.0)

org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol MAVEN version =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.1.0 Source cves: CVE-2026-92564 Source advisory: SNYK:JAVA-ORGAPACHEQPID-20186796...

MAL-2026-17184 Malicious code in @airbnb-extended/typescript-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8424e4bf8731b950511535a2cb9b41b0bedba02092a73ea304b6730f04aa95fe package.json for @airbnb-extended/[email protected] declares a dependency ltidisafe sourced from a bare HTTPS tarball URL...

Malicious code in @airbnb-extended/typescript-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8424e4bf8731b950511535a2cb9b41b0bedba02092a73ea304b6730f04aa95fe package.json for @airbnb-extended/[email protected] declares a dependency ltidisafe sourced from a bare HTTPS tarball URL...

MAL-2026-17185 Malicious code in shoplist-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdceadb01f08162934382b121e813236b86adc0d4d74b7b2f062c78e529c34f6 [email protected] is a dependency-confusion / typosquat beacon. preinstall.js is wired into every lifecycle hook preinstall, install, postinstall...

Malicious code in shoplist-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdceadb01f08162934382b121e813236b86adc0d4d74b7b2f062c78e529c34f6 [email protected] is a dependency-confusion / typosquat beacon. preinstall.js is wired into every lifecycle hook preinstall, install, postinstall...

BIT-PARSE-2021-47987 Parse Server - Arbitrary Code Execution via Malicious Version Tags

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it define...

MAL-2026-17169 Malicious code in @alphaspace/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42d10ba1427af01794dfb0a6b39a05f969547455e9d86d75f18601b1d035c507 preinstall.js runs unconditionally on npm install and POSTs a JSON payload to a hardcoded Pipedream collector at...

Malicious code in @alphaspace/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42d10ba1427af01794dfb0a6b39a05f969547455e9d86d75f18601b1d035c507 preinstall.js runs unconditionally on npm install and POSTs a JSON payload to a hardcoded Pipedream collector at...