@microsoft/applicationinsights-analytics-js (>=3.0.0-beta.2208-16, <=3.0.0-beta.2302-03), @microsoft/applicationinsights-channel-js (>=3.0.0-beta.2208-16, <=3.0.0-beta.2302-03) +11 more potentially affected by CVE-2026-46681 via @nevware21/ts-utils (>=0.3.5, <=0.7.3)

@nevware21/ts-utils NPM version =0.3.5, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =3.0.0, =3.0.0-beta.2208-16, =3.0.0-beta.2208-16, =1.0.0, =1.1.2...

@bitsocial/ai-moderation-challenge (>=0.1.0, <=0.1.1), @bitsocial/bitsocial-cli (>=0.19.44, <=0.19.72) +6 more potentially affected by CVE-2026-46679 via @libp2p/gossipsub (>=15.0.0-049bfa0fa, <=15.0.22-5692f3f16)

@libp2p/gossipsub NPM version =15.0.0-049bfa0fa, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =6.0.0-049bfa0fa, =9.0.0-049bfa0fa, =0.0.17, =0.0.47 Source cves: CVE-2026-46679 Source advisory: SNYK:JS-LIBP2PGOSSIPSUB-16798774...

@bitsocial/ai-moderation-challenge (>=0.1.0, <=0.1.1), @bitsocial/bitsocial-cli (>=0.19.44, <=0.19.72) +6 more potentially affected by CVE-2026-46679 via @libp2p/gossipsub (>=15.0.0-049bfa0fa, <=15.0.22-5692f3f16)

@libp2p/gossipsub NPM version =15.0.0-049bfa0fa, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =6.0.0-049bfa0fa, =9.0.0-049bfa0fa, =0.0.17, =0.0.47 Source cves: CVE-2026-46679 Source advisory: OSV:GHSA-4F8R-922H-2VGV...

HTTP Request Smuggling org.eclipse.jetty:jetty-http Dependency in Confluence Data Center

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This High severity HTTP Request Smuggling vulnerability known as CVE-2026-2332 was introduced in version 7.4.0, 7.13.0, 7.19.0, 8.5.0, 8.9.0,...

360shitu (0.1.0), 4icloud-engine (1.0.1) +10920 more potentially affected by CVE-2026-46625 via js-cookie (>=2.1.0, <=3.0.5)

js-cookie NPM version =2.1.0, =1.0.6, =0.1.0, =0.37.2, =0.37.2, =0.0.1, =1.0.0, =1.0.0-alpha, =1.0.0-alpha, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-46625 Source advisory: SNYK:JS-JSCOOKIE-17816999...

@0xcarbon/alore-auth-sdk (>=1.0.0-alpha, <=2.0.1-alpha), @0xcarbon/alore-auth-ui (>=1.0.0-alpha, <=3.0.0-alpha) +959 more potentially affected by CVE-2026-46625 via js-cookie (>=3.0.0, <=3.0.5)

js-cookie NPM version =3.0.0, =1.0.0-alpha, =1.0.0-alpha, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1-alpha.9, =0.0.3-alpha.1, =0.1.6-alpha.9, =0.0.1-alpha.0, =0.2.7, =1.0.25, =4.0.0-alpha.0, =4.88.5 and more Source cves: CVE-2026-46625 Source advisory: OSV:GHSA-QJX8-664M-686J...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +9 more potentially affected by CVE-2026-46673 via russh-cryptovec (0.7.3)

russh-cryptovec CARGO version 0.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on russh-cryptovec and may be impacted: - assistantdaemon 0.1.0 - async-ssh2-tokio =0.2.0, =0.1.0, =0.1.0, =0.34.0-beta.1, =0.22.0-beta.1, =0.2.0, =0.1.0, =0.4.1 - sshrpc...

@hulumi/platform-patterns (0.0.0-bootstrap.0) potentially affected by unknown CVE via @hulumi/baseline (1.3.1)

@hulumi/baseline NPM version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on @hulumi/baseline and may be impacted: - @hulumi/platform-patterns 0.0.0-bootstrap.0 Source cves: unknown CVE Source advisory: OSV:GHSA-GFP8-MP24-5VXG...

@hulumi/platform-patterns (0.0.0-bootstrap.0) potentially affected by unknown CVE via @hulumi/baseline (1.3.1)

@hulumi/baseline NPM version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on @hulumi/baseline and may be impacted: - @hulumi/platform-patterns 0.0.0-bootstrap.0 Source cves: unknown CVE Source advisory: SNYK:JS-HULUMIBASELINE-17660557...

flaskbb-plugin-atom (>=0.1.0, <=0.2.0), flaskbb-plugin-conversations (>=2.0.1, <=2.0.2) +6 more potentially affected by CVE-2026-46556 via flaskbb (2.2.0)

flaskbb PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on flaskbb and may be impacted: - flaskbb-plugin-atom =0.1.0, =2.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0 Source cves: CVE-2026-46556 Source advisory: SNYK:PYTHON-FLASKBB-17283331...

Malicious code in @remitee-money-transfer/rmt-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f21c6601855c2f2d0a5d0761d3defe8c0ba1708dd2a67fb278c03e0abd6ba16 Package ships only a preinstall lifecycle script scripts/preinstall.sh and no functional code. On npm install, the script reads /etc/passwd and...

MAL-2026-4424 Malicious code in @remitee-money-transfer/rmt-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f21c6601855c2f2d0a5d0761d3defe8c0ba1708dd2a67fb278c03e0abd6ba16 Package ships only a preinstall lifecycle script scripts/preinstall.sh and no functional code. On npm install, the script reads /etc/passwd and...

monerochan-stark (>=5.2.2, <=5.2.12), p3-circle (>=0.1.0, <=0.3.3-succinct) +20 more potentially affected by CVE-2026-46654 via p3-challenger (>=0.1.0, <=0.3.3-succinct)

p3-challenger CARGO version =0.1.0, =5.2.2, =0.1.0, =0.1.0, =0.1.0, =0.1.5-succinct, =0.1.0, =0.1.0, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.1, =6.2.1 and more Source cves: CVE-2026-46654 Source advisory: OSV:GHSA-VJ64-RJF3-W3V7...

CVE-2026-8426

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepareremoteupgrade/. An attacker who controls the remote package returned for a known marketplace item ID can overwrite the package PHP on disk and force its upgrade method to...

MAL-2026-4530 Malicious code in cloudsmith-vsc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b49ad4432747f754181e7a8428aff5fd2613f9d86283f05a04c2dd1f9ac2f2f package.json declares a preinstall hook "preinstall": "node index.js" that runs automatically on npm install. index.js reads installer-side system...

MAL-2026-4565 Malicious code in fnd-stores (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c9035e303ec731c71c689ed77eed17b245cd4adc475cb616ff94991539aa56 On npm install, the package's postinstall hook runs node index.js, which collects the installer's hostname, OS platform, current working directory, C...

nimiq-account (0.1.0), nimiq-accounts (0.1.0) +15 more potentially affected by CVE-2026-46539 via nimiq-primitives (0.1.0)

nimiq-primitives CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on nimiq-primitives and may be impacted: - nimiq-account 0.1.0 - nimiq-accounts 0.1.0 - nimiq-block 0.1.0 - nimiq-block-production 0.1.0 - nimiq-blockchain 0.1.0 -...

HTTP Request Smuggling io.netty:netty-codec-http Dependency in Jira Software Data Center

This is a vulnerability in a non-Atlassian Jira Software dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Injection vulnerability was introduced in versions 9.12.1, 9.16.0, 9.17.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0,...

@alexaegis/svelte-config (>=0.15.0, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=1.2.0, <=2.1.0) +7 more potentially affected by unknown CVE via @sveltejs/kit (>=2.39.1, <=2.59.1)

@sveltejs/kit NPM version =2.39.1, =0.15.0, =1.2.0, =0.0.137, =0.1.0, =2.0.0, =5.0.0-alpha.1, =0.0.3-next.8, =0.3.2, =1.7.0, =1.15.1 Source cves: unknown CVE Source advisory: OSV:GHSA-HGV7-V322-MMGR...

@alexaegis/svelte-config (>=0.15.0, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=1.2.0, <=2.1.0) +7 more potentially affected by unknown CVE via @sveltejs/kit (>=2.39.1, <=2.59.1)

@sveltejs/kit NPM version =2.39.1, =0.15.0, =1.2.0, =0.0.137, =0.1.0, =2.0.0, =5.0.0-alpha.1, =0.0.3-next.8, =0.3.2, =1.7.0, =1.15.1 Source cves: unknown CVE Source advisory: SNYK:JS-SVELTEJSKIT-16796279...