@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +283 more potentially affected by CVE-2026-43997 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

org.webjars.npm:degenerator (4.0.4), org.webjars.npm:pac-resolver (6.0.2) +1 more potentially affected by CVE-2026-43997 via org.webjars.npm:vm2 (3.9.19)

org.webjars.npm:vm2 MAVEN version 3.9.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:vm2 and may be impacted: - org.webjars.npm:degenerator 4.0.4 - org.webjars.npm:pac-resolver 6.0.2 - org.webjars.npm:rocket.chatapps-engine 1.35.0...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +283 more potentially affected by CVE-2026-44006 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

org.webjars.npm:degenerator (4.0.4), org.webjars.npm:pac-resolver (6.0.2) +1 more potentially affected by CVE-2026-44006 via org.webjars.npm:vm2 (3.9.19)

org.webjars.npm:vm2 MAVEN version 3.9.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:vm2 and may be impacted: - org.webjars.npm:degenerator 4.0.4 - org.webjars.npm:pac-resolver 6.0.2 - org.webjars.npm:rocket.chatapps-engine 1.35.0...

annatar (>=0.4.3, <=0.5.8), ansi2png-rs (>=0.1.0, <=0.1.1) +63 more potentially affected by unknown CVE via imageproc (>=0.6.1, <=0.22.0)

imageproc CARGO version =0.6.1, =0.4.3, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.1.0, =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W5P8-4JCX-2J6R...

sar-core (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via imageproc (0.25.0)

imageproc CARGO version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on imageproc and may be impacted: - sar-core =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:GHSA-W5P8-4JCX-2J6R...

sar-core (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via imageproc (0.25.0)

imageproc CARGO version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on imageproc and may be impacted: - sar-core =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:GHSA-QG8R-F7X3-25F7...

annatar (>=0.4.3, <=0.5.8), ansi2png-rs (>=0.1.0, <=0.1.1) +63 more potentially affected by unknown CVE via imageproc (>=0.6.1, <=0.22.0)

imageproc CARGO version =0.6.1, =0.4.3, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.1.0, =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-QG8R-F7X3-25F7...

sar-core (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via imageproc (0.25.0)

imageproc CARGO version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on imageproc and may be impacted: - sar-core =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:GHSA-5QV7-J6W5-FR4M...

acme-validation-propagation (>=0.1.5, <=0.1.8), agnostic (>=0.2.1, <=0.2.6) +37 more potentially affected by unknown CVE via hickory-proto (>=0.24.4, <=0.25.0-alpha.5)

hickory-proto CARGO version =0.24.4, =0.1.5, =0.2.1, =0.24.0, =0.9.3, =0.1.0, =0.5.0, =0.1.0, =0.0.1, =0.2.6, =0.2.8 - getip 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q2QQ-HMJ6-3WPP...

async-std-resolver (>=0.25.0-alpha.1, <=0.25.0-alpha.5), ezk-sip-ua (>=0.5.0, <=0.7.1) +5 more potentially affected by unknown CVE via hickory-proto (>=0.25.0-alpha.1, <=0.25.0-alpha.5)

hickory-proto CARGO version =0.25.0-alpha.1, =0.25.0-alpha.1, =0.5.0, =0.25.0-alpha.1, =0.25.0-alpha.5 - hickory-resolver 0.25.0-alpha.1 - hickory-server 0.25.0-alpha.1 - shadowsocks 1.22.0 Source cves: unknown CVE Source advisory: OSV:GHSA-3V94-MW7P-V465...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to improper validation of HTTPS certificates in the parser process. An attacker can inject or modify remote CSS content by performing a man-in-the-middle attack during stylesheet loading over HTTPS...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to missing authentication middleware in the smPolicyGroup route group, which allows unauthenticated requests to access sensitive endpoints. An attacker can gain unauthorized access to subscriber information,...

GHSA-98QH-XJC8-98PQ vulnerabilities

Vulnerabilities for packages: nacos-docker, hono, apache-hop, flyway-fips, kayenta, geoserver, nuxeo, nacos, keycloak-fips, sonarqube, apache-hop-fips, guacamole-client, keycloak, flyway, camunda, camunda-zeebe, druid, ghidra, dependency-track, kayenta-fips, debezium, dependency-track-apiserver,...

CVE-2026-42198 vulnerabilities

Vulnerabilities for packages: nacos-docker, hono, apache-hop, flyway-fips, kayenta, geoserver, nuxeo, nacos, keycloak-fips, sonarqube, apache-hop-fips, guacamole-client, keycloak, flyway, camunda, camunda-zeebe, druid, ghidra, dependency-track, kayenta-fips, debezium, dependency-track-apiserver,...

@caliperai/caliper (>=0.2.0, <=0.3.0), @doccov/api (>=0.6.0, <=0.6.4) +12 more potentially affected by CVE-2026-44479 via vercel (>=50.41.0, <=51.8.0)

vercel NPM version =50.41.0, =0.2.0, =0.6.0, =0.3.0-rc.2, =3.10.3, =1.1.1, =1.0.1, =1.0.2, =0.1.19, =0.4.0-rc.3, =1.0.0, =2.0.0 Source cves: CVE-2026-44479 Source advisory: OSV:GHSA-PGF8-2HGJ-GRQG...

@caliperai/caliper (>=0.2.0, <=0.3.0), @doccov/api (>=0.6.0, <=0.6.4) +12 more potentially affected by CVE-2026-44479 via vercel (>=50.41.0, <=51.8.0)

vercel NPM version =50.41.0, =0.2.0, =0.6.0, =0.3.0-rc.2, =3.10.3, =1.1.1, =1.0.1, =1.0.2, =0.1.19, =0.4.0-rc.3, =1.0.0, =2.0.0 Source cves: CVE-2026-44479 Source advisory: SNYK:JS-VERCEL-16638653...

armature-diesel (0.1.0), authzen (0.1.0-alpha.0) +21 more potentially affected by unknown CVE via diesel-async (>=0.1.1, <=0.6.1)

diesel-async CARGO version =0.1.1, =0.1.0, =0.18.0-rc.4, =0.18.0-rc.4, =0.18.0-rc.4, =0.18.0-rc.4, =0.17.0, =0.17.0, =0.19.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-FF9Q-RM55-Q7QR...

gix-lock (>=5.0.0, <=12.0.1), gix-tempfile (>=5.0.3, <=12.0.1) potentially affected by CVE-2026-44471 via gix-fs (>=0.1.1, <=0.9.1)

gix-fs CARGO version =0.1.1, =5.0.0, =5.0.3, =12.0.1 Source cves: CVE-2026-44471 Source advisory: OSV:GHSA-F89H-2FJH-2R9Q...

Malicious code in camelotlabs-config (npm)

Five packages camelotlabs-sdk, camelotlabs-core, camelotlabs-config, camelotlabs-worker, and camelotlabs-utils were published to the public npm registry at version 99.0.0 by the actor madman0619 as a dependency confusion attack targeting the internal npm packages of Camelot Labs. The inflated...