amundsen-metadata (>=2.5.5, <=3.5.0), bspider (>=0.0.5a0, <=0.0.8) +13 more potentially affected by CVE-2026-102598 via werkzeug (0.15.5)

werkzeug PYPI version 0.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - amundsen-metadata =2.5.5, =0.0.5a0, =1.3.1, =1.2.3, =0.1.3, =0.0.1, =0.0.9, =0.50.0, =1.0.6, =0.1.0, =4.2.0, =0.10.21, =0.15.37 Source cves:...

abstra (>=1.8.8, <=2.5.1), acceldata-o2a (1.0.0) +241 more potentially affected by CVE-2026-102598 via werkzeug (2.2.3)

werkzeug PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - abstra =1.8.8, =0.2.1, =1.1.0rc2, =0.0.1, =0.1.1, =0.0.4, =0.0.1, =2023.8.1.11, =0.58.0, =2.7.3rc1, =1.0.0rc1, =1.6.0b1 and more Source cves:...

aaz-dev (>=1.0.2, <=2.10.1), adminui (1.5.2) +190 more potentially affected by CVE-2026-102598 via werkzeug (2.1.2)

werkzeug PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - aaz-dev =1.0.2, =1.5.2, =0.14.0, =0.0.1a0, =1.5.0, =1.1.1, =2.6.0, =1.0.5, =1.7.1, =1.3.0, =3.1.0, =1.45.0, =1.47.0 and more Source cves:...

2context (>=0.1.0, <=0.2.0), 2ndopinion-cli (>=0.1.0, <=0.12.0) +8762 more potentially affected by CVE-2026-102828 via simple-git (>=3.15.0, <=3.36.0)

simple-git NPM version =3.15.0, =0.1.0, =0.1.0, =0.16.0, =0.0.112-rc1, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0, =1.0.3, =1.1.0, =0.1.0, =0.3.0 and more Source cves: CVE-2026-102828 Source advisory: OSV:GHSA-X6JW-M9V5-85VH...

2context (>=0.1.0, <=0.2.0), 2ndopinion-cli (>=0.1.0, <=0.12.0) +8762 more potentially affected by CVE-2026-102828 via simple-git (>=3.15.0, <=3.36.0)

simple-git NPM version =3.15.0, =0.1.0, =0.1.0, =0.16.0, =0.0.112-rc1, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0, =1.0.3, =1.1.0, =0.1.0, =0.3.0 and more Source cves: CVE-2026-102828 Source advisory: GHSA-X6JW-M9V5-85VH...

inmanta (2016.6.0) potentially affected by CVE-2026-96749 via pymongo (2.7.0)

pymongo PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - inmanta 2016.6.0 Source cves: CVE-2026-96749 Source advisory: OSV:GHSA-V4X9-3549-CRWV...

capreolus (>=0.1.0, <=0.1.5), ckanext-nhm (>=3.7.1, <=6.9.8) +19 more potentially affected by CVE-2026-96749 via pymongo (3.9.0)

pymongo PYPI version 3.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - capreolus =0.1.0, =3.7.1, =3.0.2, =3.7.0, =0.2.0, =0.0.2, =0.0.2, =0.9.2rc1, =0.0.2, =0.1.2, =0.0.1, =0.0.8 and more Source cves: CVE-2026-96749...

aleph-alpha-inference (1.0.0), evoke-vllm (>=0.1.0, <=0.1.1) +6 more potentially affected by CVE-2026-105758 via vllm (>=0.24.0, <=0.29.0)

vllm PYPI version =0.24.0, =0.1.0, =2.9.0, =2.3.0, =0.1.10, =0.1.0, =0.1.4 Source cves: CVE-2026-105758 Source advisory: GHSA-X6MC-67GF-CHW4...

@a-r-m-i-n/opencode-openai-usage (>=0.1.0, <=0.1.1), @aexol/opencode-tui (>=0.2.4, <=0.4.1) +450 more potentially affected by CVE-2026-104846 via seroval (>=0.12.4, <=1.6.0)

seroval NPM version =0.12.4, =0.1.0, =0.2.4, =0.1.2, =0.0.6, =1.20.47, =0.3.0, =0.1.0, =0.13.0, =2.11.0, =1.0.2, =1.0.0, =0.0.1, =0.6.3 and more Source cves: CVE-2026-104846 Source advisory: OSV:GHSA-P6VX-979V-RG4C...

bloomtechlib (0.0.1), cocktail-apikit (>=0.1.20, <=0.1.22) +30 more potentially affected by CVE-2026-88029 via pymongo (3.11.4)

pymongo PYPI version 3.11.4 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - bloomtechlib 0.0.1 - cocktail-apikit =0.1.20, =0.1.8, =0.0.3, =1.0.0, =0.1.3, =0.1.0, =0.2.1, =1.0.1, =0.11.0, =0.0.23, =1.0.1, =1.0.0, =1.2.5 an...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index through malformed LLB op validation in the solver’s SourceOp and DiffOp handling. An attacker can crash buildkitd by submitting a crafted LLB definition with an input/dependency count mismatch. The...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +291 more potentially affected by CVE-2026-100721 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +291 more potentially affected by CVE-2026-100721 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

aleph-alpha-inference (1.0.0), evoke-vllm (>=0.1.0, <=0.1.1) +7 more potentially affected by CVE-2026-105760 via vllm (>=0.23.0, <=0.29.0)

vllm PYPI version =0.23.0, =0.1.0, =2.9.0, =2.2.2, =0.1.10, =0.1.0, =0.1.4 Source cves: CVE-2026-105760 Source advisory: MEND:CVE-2026-105760...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +291 more potentially affected by CVE-2026-100723 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +195 more potentially affected by CVE-2026-104852 via @graphql-tools/utils (>=12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, <=12.0.0)

@graphql-tools/utils NPM version =12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, =1.0.11, =0.0.1, =1.0.0, =0.0.6, =1.2.5, =2.0.0, =1.0.8, =1.0.0, =1.0.7, =0.0.1, =1.0.0, =0.0.73, =0.0.3, =0.0.44 and more Source cves: CVE-2026-104852 Source advisory: GHSA-7MX3-VVMW-HJMV...

com.codbex.atlas:codbex-atlas-application (>=2.97.0, <=14.49.0), com.codbex.gaia:codbex-gaia-application (>=2.73.0, <=14.49.0) +50 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (>=4.0.0, <=4.3.3)

net.snowflake:snowflake-jdbc MAVEN version =4.0.0, =2.97.0, =2.73.0, =2.72.0, =2.72.0, =2.65.0, =2.68.0, =3.27.0, =2.64.0, =0.10.0, =0.10.0, =0.10.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.3 and more Source cves: CVE-2026-86597 Source advisory: OSV:GHSA-QQJ6-54Q6-CXV6...

org.finos.legend-community:legend-delta (>=0.1.3, <=0.1.10), org.finos.legend.engine.ide.lsp:legend-engine-ide-lsp-default-extensions (>=0.6.0, <=0.34.0) +62 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.13.5)

net.snowflake:snowflake-jdbc MAVEN version 3.13.5 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - org.finos.legend-community:legend-delta =0.1.3, =0.6.0, =0.1.1, =4.29.1, =2.50.0, =2.36.0, =2.36.0,...

airbyte (>=0.11.0, <=0.27.0), airbyte-destination-pgvector (>=0.1.0, <=0.1.4) +119 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.18.1)

snowflake-connector-python PYPI version 3.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - airbyte =0.11.0, =0.1.0, =0.0.1, =0.1.5, =0.1.1, =0.4.6, =0.0.25, =0.1.9, =1.0.5, =1.0.1, =2.0.2, =2.1.0 an...

pipelinewise-target-snowflake (>=1.2.0, <=1.8.0), schemaql (>=0.0.2, <=0.0.4) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.0.3)

snowflake-connector-python PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - pipelinewise-target-snowflake =1.2.0, =0.0.2, =0.0.4 Source cves: CVE-2026-86597 Source advisory:...