MAL-2026-17476 Malicious code in css-anchor-pos-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05 The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id, whoami, uname...

MAL-2026-17475 Malicious code in css-a11y-contrast-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ad65ab7d49c4277898f5da5b5d45f3ec9cde46035bcf6416e3a95507ca1301 [email protected] is advertised as a WCAG contrast utility but ships no contrast code — index.js exports an empty object. The package...

Malicious code in css-a11y-contrast-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ad65ab7d49c4277898f5da5b5d45f3ec9cde46035bcf6416e3a95507ca1301 [email protected] is advertised as a WCAG contrast utility but ships no contrast code — index.js exports an empty object. The package...

Malicious code in focus-visible-polyfill-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5225b5a8636a589f9b90272ad04c3f4104670a23d5c24b45f6aeaa757a4f2a2b The package is advertised as a focus-visible polyfill but ships thunderboltRegistry.js, which impersonates Wix thunderbolt internal registry modules...

MAL-2026-17491 Malicious code in focus-visible-polyfill-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5225b5a8636a589f9b90272ad04c3f4104670a23d5c24b45f6aeaa757a4f2a2b The package is advertised as a focus-visible polyfill but ships thunderboltRegistry.js, which impersonates Wix thunderbolt internal registry modules...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: scala, opensearch, spdx-tools-java, keycloak, strimzi-kafka-operator, tez, gradle, infinispan, apache-tika, sonarqube, keycloak-config-cli, apicurio-registry, apache-nifi-registry, trino, cass-config-builder, akhq, apache-nifi, wildfly, dependency-track, logstash,...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: scala, opensearch, spdx-tools-java, keycloak, strimzi-kafka-operator, tez, gradle, infinispan, apache-tika, sonarqube, keycloak-config-cli, apicurio-registry, apache-nifi-registry, trino, cass-config-builder, akhq, apache-nifi, wildfly, dependency-track, logstash,...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +19383 more potentially affected by CVE-2026-18040 via org.bouncycastle:bcprov-jdk18on (>=1.73, <=1.85.2)

org.bouncycastle:bcprov-jdk18on MAVEN version =1.73, =0.2.0, =0.9.3, =0.4.0, =0.9.4, =0.9.7, =0.8.0, =0.8.0, =0.9.6, =0.6.0, =0.9.3, =0.4.0, =0.4.0, =0.9.8 and more Source cves: CVE-2026-18040 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536929...

ai.covia:covia-claude-code (>=0.9.3, <=0.9.8), ai.covia:covia-core (>=0.4.0, <=0.9.8) +11029 more potentially affected by CVE-2026-71888 via org.bouncycastle:bcpkix-jdk18on (>=1.71, <=1.85)

org.bouncycastle:bcpkix-jdk18on MAVEN version =1.71, =0.9.3, =0.4.0, =0.9.4, =0.9.7, =0.8.0, =0.8.0, =0.9.6, =0.6.0, =0.9.3, =0.4.0, =0.4.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.9.2 and more Source cves: CVE-2026-71888 Source advisory: MEND:CVE-2026-71888...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.8.0), com.pkixops:pkixops-crypto (1.5.2) +164 more potentially affected by CVE-2026-71889 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.56.0 and more Source cves: CVE-2026-71889 Source advisory: MEND:CVE-2026-71889...

ai.covia:covia-claude-code (>=0.9.3, <=0.9.8), ai.covia:covia-core (>=0.4.0, <=0.9.8) +9969 more potentially affected by CVE-2026-71889 via org.bouncycastle:bcpkix-jdk18on (>=1.74, <=1.85)

org.bouncycastle:bcpkix-jdk18on MAVEN version =1.74, =0.9.3, =0.4.0, =0.9.4, =0.9.7, =0.8.0, =0.8.0, =0.9.6, =0.6.0, =0.9.3, =0.4.0, =0.4.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.9.2 and more Source cves: CVE-2026-71889 Source advisory: MEND:CVE-2026-71889...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +19981 more potentially affected by CVE-2026-71889 via org.bouncycastle:bcprov-jdk18on (>=1.71, <=1.85.2)

org.bouncycastle:bcprov-jdk18on MAVEN version =1.71, =0.2.0, =0.9.3, =0.4.0, =0.9.4, =0.9.7, =0.8.0, =0.8.0, =0.9.6, =0.6.0, =0.9.3, =0.4.0, =0.4.0, =0.9.8 and more Source cves: CVE-2026-71889 Source advisory: MEND:CVE-2026-71889...

[SECURITY] Fedora 45 Update: libsolv-0.7.40-2.fc45

A free package dependency solver using a satisfiability algorithm. The library is based on two major, but independent, blocks: - Using a dictionary approach to store and retrieve package and dependency information. - Using satisfiability, a well known and researched topic, for resolving package...

0xble (>=22.0.0, <=23.2.2), 0xsodium (>=0.2.0, <=0.14.0) +14217 more potentially affected by CVE-2026-19481 via @fastify/busboy (>=1.0.0, <=3.2.0)

@fastify/busboy NPM version =1.0.0, =22.0.0, =0.2.0, =0.0.1, =1.0.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.0.21, =0.6.0, =0.6.2 and more Source cves: CVE-2026-19481 Source advisory: OSV:GHSA-X8MW-P69M-V3MX...

@awmottaz/grackle (>=3.0.0, <=3.2.0), @beiguancyc/parse-server (>=9.9.0-ruixiang.1, <=9.10.0-ruixiang.4) +14 more potentially affected by CVE-2026-19484 via @fastify/busboy (>=3.1.1, <=3.2.0)

@fastify/busboy NPM version =3.1.1, =3.0.0, =9.9.0-ruixiang.1, =0.37.0, =0.8.22, =0.9.21, =1.0.4, =1.0.0, =4.5.0-blowfish-pre, =11.1.1-9.0, =6.1.1, =3.31.25, =9.2.8-0, =9.10.0-1, =0.27.0, =4.0.0, =4.2.0 and more Source cves: CVE-2026-19484 Source advisory: GHSA-XJH9-V7X6-24JW...

abe-bft (1.0.0), adversarial-workflow (>=0.4.0, <=0.9.8) +408 more potentially affected by CVE-2026-104874 via multidict (>=6.7.0, <=6.8.0)

multidict PYPI version =6.7.0, =0.4.0, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =0.1.0, =1.0.5, =25.11.0, =0.7.0, =0.7.1 and more Source cves: CVE-2026-104874 Source advisory: SNYK:PYTHON-MULTIDICT-20510280...

abe-bft (1.0.0), actscene-ocr (>=0.1.3, <=0.1.5) +527 more potentially affected by CVE-2026-104874 via multidict (>=6.3.0, <=6.8.0)

multidict PYPI version =6.3.0, =0.1.3, =0.4.0, =0.1.0, =0.1.0, =0.87.2.dev9, =0.80.1, =0.1.0.dev19, =1.3.0, =0.1.0, =0.1.0, =1.0.5, =1.0.6 and more Source cves: CVE-2026-104874 Source advisory: MEND:CVE-2026-104874...

CVE-2026-103956 Missing authentication for critical function in Loom for AWS

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-103956 Missing authentication for critical function in Loom for AWS

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-103956

Loom for AWS versions before 1.6.1 are vulnerable to a critical flaw due to missing authentication for a critical function within the authentication dependency. In deployments where no identity provider is configured, remote actors can exploit this via any request to the application API to obtain...