@vrabbi/backstage-devtools-wrapper (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-44374 via @backstage/plugin-catalog-unprocessed-entities (0.1.4)

@backstage/plugin-catalog-unprocessed-entities NPM version 0.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-catalog-unprocessed-entities and may be impacted: - @vrabbi/backstage-devtools-wrapper =0.2.0, =0.2.1 Source cves:...

@backstage/plugin-catalog-backend-module-unprocessed (>=0.0.0-nightly-20240321021124, <=0.6.10), @backstage/plugin-catalog-unprocessed-entities (>=0.0.0-nightly-20251203024610, <=0.2.29) potentially affected by CVE-2026-44374 via @backstage/plugin-catalog-unprocessed-entities-common (>=0.0.0-nightly-20241116023418, <=0.0.14-next.0)

@backstage/plugin-catalog-unprocessed-entities-common NPM version =0.0.0-nightly-20241116023418, =0.0.0-nightly-20240321021124, =0.0.0-nightly-20251203024610, =0.2.29 Source cves: CVE-2026-44374 Source advisory: OSV:GHSA-P7G9-RP3G-MGFG...

@augu/fastify-nitro (>=1.0.0, <=1.2.0), @bicou/countries-server (>=1.5.0, <=1.6.7) +26 more potentially affected by CVE-2026-44372 via nitropack (>=2.1.0, <=2.13.1)

nitropack NPM version =2.1.0, =1.0.0, =1.5.0, =0.4.4, =0.6.1, =1.0.0, =1.0.0, =5.0.0-rc.212, =5.0.0-rc.212, =3.0.0, =4.0.0-alpha.1, =4.0.0-29145487.7beaa672, =7.40.3, =0.0.0-beta.0, =1.15.3, =1.31.24 and more Source cves: CVE-2026-44372 Source advisory: SNYK:JS-NITROPACK-16757946...

@100x/application (>=0.0.1, <=0.0.6), @aero-js/cli (0.4.0) +60 more potentially affected by CVE-2026-44372 via nitro (>=3.0.0, <=3.0.260415-beta)

nitro NPM version =3.0.0, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =0.2.9, =2.4.0-alpha.2, =3.0.0-alpha.55 and more Source cves: CVE-2026-44372 Source advisory: SNYK:JS-NITRO-16757947...

@augu/fastify-nitro (>=1.0.0, <=1.2.0), @bicou/countries-server (>=1.5.0, <=1.6.7) +26 more potentially affected by CVE-2026-44372 via nitropack (>=2.1.0, <=2.13.1)

nitropack NPM version =2.1.0, =1.0.0, =1.5.0, =0.4.4, =0.6.1, =1.0.0, =1.0.0, =5.0.0-rc.212, =5.0.0-rc.212, =3.0.0, =4.0.0-alpha.1, =4.0.0-29145487.7beaa672, =7.40.3, =0.0.0-beta.0, =1.15.3, =1.31.24 and more Source cves: CVE-2026-44372 Source advisory: OSV:GHSA-9PHM-9P8F-HW5M...

@100x/application (>=0.0.1, <=0.0.6), @aero-js/cli (0.4.0) +60 more potentially affected by CVE-2026-44372 via nitro (>=3.0.0, <=3.0.260415-beta)

nitro NPM version =3.0.0, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =0.2.9, =2.4.0-alpha.2, =3.0.0-alpha.55 and more Source cves: CVE-2026-44372 Source advisory: OSV:GHSA-9PHM-9P8F-HW5M...

@100x/application (>=0.0.1, <=0.0.6), @aero-js/cli (0.4.0) +60 more potentially affected by CVE-2026-44373 via nitro (>=3.0.0, <=3.0.260415-beta)

nitro NPM version =3.0.0, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =0.2.9, =2.4.0-alpha.2, =3.0.0-alpha.55 and more Source cves: CVE-2026-44373 Source advisory: SNYK:JS-NITRO-16757954...

@100x/application (>=0.0.1, <=0.0.6), @aero-js/cli (0.4.0) +60 more potentially affected by CVE-2026-44373 via nitro (>=3.0.0, <=3.0.260415-beta)

nitro NPM version =3.0.0, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =0.2.9, =2.4.0-alpha.2, =3.0.0-alpha.55 and more Source cves: CVE-2026-44373 Source advisory: OSV:GHSA-5W89-W975-HF9Q...

@augu/fastify-nitro (>=1.0.0, <=1.2.0), @bicou/countries-server (>=1.5.0, <=1.6.7) +26 more potentially affected by CVE-2026-44373 via nitropack (>=2.1.0, <=2.13.1)

nitropack NPM version =2.1.0, =1.0.0, =1.5.0, =0.4.4, =0.6.1, =1.0.0, =1.0.0, =5.0.0-rc.212, =5.0.0-rc.212, =3.0.0, =4.0.0-alpha.1, =4.0.0-29145487.7beaa672, =7.40.3, =0.0.0-beta.0, =1.15.3, =1.31.24 and more Source cves: CVE-2026-44373 Source advisory: SNYK:JS-NITROPACK-16757953...

@augu/fastify-nitro (>=1.0.0, <=1.2.0), @bicou/countries-server (>=1.5.0, <=1.6.7) +26 more potentially affected by CVE-2026-44373 via nitropack (>=2.1.0, <=2.13.1)

nitropack NPM version =2.1.0, =1.0.0, =1.5.0, =0.4.4, =0.6.1, =1.0.0, =1.0.0, =5.0.0-rc.212, =5.0.0-rc.212, =3.0.0, =4.0.0-alpha.1, =4.0.0-29145487.7beaa672, =7.40.3, =0.0.0-beta.0, =1.15.3, =1.31.24 and more Source cves: CVE-2026-44373 Source advisory: OSV:GHSA-5W89-W975-HF9Q...

GHSA-2CCX-CJJH-R2J8 MediaMTX affected by CVE-2026-27143 due to vulnerable dependency

Summary Release 1.17.1 seems affected by CVE-2026-27143. golang 1.25.9 Seems to solve the issue. Is there any new release planned? Details See https://nvd.nist.gov/vuln/detail/CVE-2026-27143...

@jsprismarine/client (>=0.12.2-unstable-20250320195345, <=0.13.1), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.13.1) +1 more potentially affected by CVE-2026-44351 via fast-jwt (>=6.0.0, <=6.0.1)

fast-jwt NPM version =6.0.0, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.13.1 Source cves: CVE-2026-44351 Source advisory: SNYK:JS-FASTJWT-16439016...

@jsprismarine/client (>=0.12.2-unstable-20250320195345, <=0.13.1), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.13.1) +1 more potentially affected by CVE-2026-44351 via fast-jwt (>=6.0.0, <=6.0.1)

fast-jwt NPM version =6.0.0, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.13.1 Source cves: CVE-2026-44351 Source advisory: OSV:GHSA-GMVF-9V4P-V8JC...

lemmy_server (>=0.11.3-rc.5, <=0.16.7) potentially affected by unknown CVE via lemmy_api (>=0.11.3-rc.5, <=0.16.7)

lemmyapi CARGO version =0.11.3-rc.5, =0.11.3-rc.5, =0.16.7 Source cves: unknown CVE Source advisory: OSV:GHSA-95Q8-X6R6-672M...

lemmy_server (>=0.11.3-rc.5, <=0.16.7) potentially affected by unknown CVE via lemmy_api (>=0.11.3-rc.5, <=0.16.7)

lemmyapi CARGO version =0.11.3-rc.5, =0.11.3-rc.5, =0.16.7 Source cves: unknown CVE Source advisory: OSV:GHSA-JMXC-HHWX-GVV3...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the GET /api/v1/stable/dags/tasks endpoint via improper tenant checks in the listTasksByDAGIds function. An attacker can access sensitive task metadata belonging to other tenants by...

ironhide (>=1.0.0, <=1.0.7), rorm-cli (0.5.0) +1 more potentially affected by unknown CVE via rpassword (>=7.0.0, <=7.2.0)

rpassword CARGO version =7.0.0, =1.0.0, =0.1.0, =0.1.4 Source cves: unknown CVE Source advisory: OSV:GHSA-2P6R-X3VV-XQM2...

@datalayer/jupyter-react (>=0.0.6, <=0.9.5), @jupyter-notebook/application (>=7.1.0-alpha.0, <=7.4.7) +7 more potentially affected by CVE-2026-42557 via @jupyterlab/rendermime-interfaces (>=3.1.18, <=3.12.10)

@jupyterlab/rendermime-interfaces NPM version =3.1.18, =0.0.6, =7.1.0-alpha.0, =0.1.0-alpha.23, =0.1.0-alpha.7, =0.3.0-alpha.0, =0.1.0-alpha.23, =0.0.23, =0.2.0-alpha.0, =0.1.1, =0.2.2 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABRENDERMIMEINTERFACES-16438959...

@datalayer/jupyter-react (>=0.0.6, <=0.9.5), @mrawdon/jupyter-react (>=0.0.23, <=0.0.32) potentially affected by CVE-2026-42557 via @jupyterlab/rendermime-extension (>=4.0.0, <=4.1.0-beta.0)

@jupyterlab/rendermime-extension NPM version =4.0.0, =0.0.6, =0.0.23, =0.0.32 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABRENDERMIMEEXTENSION-16438958...

@datalayer/jupyter-react (0.9.5) potentially affected by CVE-2026-42557 via @jupyterlab/notebook-extension (4.1.0-beta.0)

@jupyterlab/notebook-extension NPM version 4.1.0-beta.0 is affected by a known vulnerability. The following packages have a transitive dependency on @jupyterlab/notebook-extension and may be impacted: - @datalayer/jupyter-react 0.9.5 Source cves: CVE-2026-42557 Source advisory:...