@leav/ui (>=1.13.0-0ceda52e, <=1.14.0) potentially affected by CVE-2026-47423 via dompurify (3.4.4)

dompurify NPM version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on dompurify and may be impacted: - @leav/ui =1.13.0-0ceda52e, =1.14.0 Source cves: CVE-2026-47423 Source advisory: SNYK:JS-DOMPURIFY-17119837...

@agenticmail/api (>=0.6.0, <=0.7.21), @agenticmail/claudecode (>=0.1.0, <=0.1.17) +1 more potentially affected by CVE-2026-50287 via @agenticmail/mcp (>=0.6.2, <=0.7.9)

@agenticmail/mcp NPM version =0.6.2, =0.6.0, =0.1.0, =0.6.0, =0.8.36 Source cves: CVE-2026-50287 Source advisory: SNYK:JS-AGENTICMAILMCP-17751067...

@agenticmail/api (>=0.6.0, <=0.7.21), @agenticmail/claudecode (>=0.1.0, <=0.1.17) +1 more potentially affected by CVE-2026-50287 via @agenticmail/mcp (>=0.6.2, <=0.7.9)

@agenticmail/mcp NPM version =0.6.2, =0.6.0, =0.1.0, =0.6.0, =0.8.36 Source cves: CVE-2026-50287 Source advisory: OSV:GHSA-63GR-G7JC-V8RG...

com.browseengine.bobo:bobo-solr (>=3.0.0, <=3.2.0), com.browseengine.bobo:cardemo (>=3.0.0, <=3.2.0) +348 more potentially affected by CVE-2026-44825 via org.apache.solr:solr-core (>=1.3.0, <=10.0.0)

org.apache.solr:solr-core MAVEN version =1.3.0, =3.0.0, =3.0.0, =1.8.6, =0.40, =0.40, =0.3.1, =0.3.4, =0.3.4, =1.0.3, =1.0.3, =1.0.3, =1.0.5 and more Source cves: CVE-2026-44825 Source advisory: SNYK:JAVA-ORGAPACHESOLR-17139337...

GHSA-GPRJ-XVQ8-W53Q Apache Airflow has an Improper Authorization issue

The structuredata endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could enumerate linked Dag IDs and dependency metadata for other...

CVE-2026-40963

The structuredata endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could enumerate linked Dag IDs and dependency metadata for other...

Malicious code in @customer-threesixty/assets (npm)

Dependency confusion attack campaign targeting Scandinavian telecommunications and digital services organizations Telenor, Ownit, Vimla, and Customer 360 / C360. Four packages published by the debating0166 npm account use inflated version numbers 99.0.x to win npm registry resolution over private...

Malicious code in @telenor-se/core (npm)

Dependency confusion attack campaign targeting Scandinavian telecommunications and digital services organizations Telenor, Ownit, Vimla, and Customer 360 / C360. Four packages published by the debating0166 npm account use inflated version numbers 99.0.x to win npm registry resolution over private...

MAL-2026-5155 Malicious code in @ownit/core (npm)

Dependency confusion attack campaign targeting Scandinavian telecommunications and digital services organizations Telenor, Ownit, Vimla, and Customer 360 / C360. Four packages published by the debating0166 npm account use inflated version numbers 99.0.x to win npm registry resolution over private...

Malicious code in @ownit/core (npm)

Dependency confusion attack campaign targeting Scandinavian telecommunications and digital services organizations Telenor, Ownit, Vimla, and Customer 360 / C360. Four packages published by the debating0166 npm account use inflated version numbers 99.0.x to win npm registry resolution over private...

MAL-2026-5157 Malicious code in @tse-digital/core (npm)

Dependency confusion attack campaign targeting Scandinavian telecommunications and digital services organizations Telenor, Ownit, Vimla, and Customer 360 / C360. Four packages published by the debating0166 npm account use inflated version numbers 99.0.x to win npm registry resolution over private...

MAL-2026-5154 Malicious code in @customer-threesixty/assets (npm)

Dependency confusion attack campaign targeting Scandinavian telecommunications and digital services organizations Telenor, Ownit, Vimla, and Customer 360 / C360. Four packages published by the debating0166 npm account use inflated version numbers 99.0.x to win npm registry resolution over private...

Malicious code in @tse-digital/core (npm)

Dependency confusion attack campaign targeting Scandinavian telecommunications and digital services organizations Telenor, Ownit, Vimla, and Customer 360 / C360. Four packages published by the debating0166 npm account use inflated version numbers 99.0.x to win npm registry resolution over private...

MAL-2026-5156 Malicious code in @telenor-se/core (npm)

Dependency confusion attack campaign targeting Scandinavian telecommunications and digital services organizations Telenor, Ownit, Vimla, and Customer 360 / C360. Four packages published by the debating0166 npm account use inflated version numbers 99.0.x to win npm registry resolution over private...

CVE-2026-40963 Apache Airflow: DAG authorization bypass on /ui/structure/structure_data

The structuredata endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could enumerate linked Dag IDs and dependency metadata for other...

CVE-2026-40963 Apache Airflow: DAG authorization bypass on /ui/structure/structure_data

The structuredata endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could enumerate linked Dag IDs and dependency metadata for other...

CVE-2026-40963

The structuredata endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could enumerate linked Dag IDs and dependency metadata for other...

agent-vm-hermes-adapter (>=0.0.116, <=0.0.132), apify-hermes-agent-plugin (>=0.1.0, <=0.1.1) +15 more potentially affected by CVE-2026-10224 via hermes-agent (>=0.13.0, <=0.19.0)

hermes-agent PYPI version =0.13.0, =0.0.116, =0.1.0, =0.1.3, =0.1.0, =3.0.0, =0.1.2, =2.5.17, =0.3.0, =0.1.0a16, =1.0.1, =1.0.0, =1.0.2, =0.1.0a0, =0.10.0, =0.10.7 and more Source cves: CVE-2026-10224 Source advisory: SNYK:PYTHON-HERMESAGENT-18507995...

agent-vm-hermes-adapter (>=0.0.116, <=0.0.132), apify-hermes-agent-plugin (>=0.1.0, <=0.1.1) +15 more potentially affected by CVE-2026-10221 via hermes-agent (>=0.13.0, <=0.19.0)

hermes-agent PYPI version =0.13.0, =0.0.116, =0.1.0, =0.1.3, =0.1.0, =3.0.0, =0.1.2, =2.5.17, =0.3.0, =0.1.0a16, =1.0.1, =1.0.0, =1.0.2, =0.1.0a0, =0.10.0, =0.10.7 and more Source cves: CVE-2026-10221 Source advisory: SNYK:PYTHON-HERMESAGENT-18507994...

Apache Airflow 安全漏洞

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. This platform features scalability and dynamic monitoring capabilities. There is a security vulnerability in Apache Airflow. The...