-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +1345 more potentially affected by CVE-2026-94543 via next (>=15.0.0, <=15.5.25)

next NPM version =15.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2026-94543 Source advisory: SNYK:JS-NEXT-20569641...

ai.chatur:cortex-core (>=0.0.1, <=0.1.4), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +6577 more potentially affected by CVE-2026-61374 via org.apache.thrift:libthrift (>=0.6.1, <=0.24.0)

org.apache.thrift:libthrift MAVEN version =0.6.1, =0.0.1, =0.0.1, =0.0.1, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =chaining-0.0.46-dev, =chaining-0.0.46-de...

0lever-utils (>=0.1.0, <=0.1.6), agents-schema (>=0.0.8, <=0.0.11) +252 more potentially affected by CVE-2026-66858 via thrift (>=0.9.2, <=0.24.0)

thrift PYPI version =0.9.2, =0.1.0, =0.0.8, =0.1.0, =0.1.0, =0.0.1, =1.0.1, =0.1.0, =0.13.3, =0.6.6, =1.0.6, =2.7.0rc1, =0.1.0, =0.0.32, =0.1.9, =0.1.12 and more Source cves: CVE-2026-66858 Source advisory: SNYK:PYTHON-THRIFT-20417194...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.8.0), com.pkixops:pkixops-crypto (1.5.2) +164 more potentially affected by CVE-2026-17508 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.56.0 and more Source cves: CVE-2026-17508 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20535447...

app.cash.bittycity:outie (0.0.1), app.cash.bittycity:outie-jooq-provider (0.0.1) +1290 more potentially affected by CVE-2026-18036 via org.bouncycastle:bcprov-jdk15to18 (>=1.73, <=1.85.2)

org.bouncycastle:bcprov-jdk15to18 MAVEN version =1.73, =0.0.2, =0.0.2.1, =0.1.0-m36, =0.1.0-m27, =1.0.1-rc14, =3.5.0.0, =3.5.5.3 - cn.lnkdoc.sdk:awesome-uia-alipay-sdk 3.0.0-rc1 - cn.lnkdoc.sdk:awesome-uia-alipay-sdk-solon-boot-2-starter 3.0.0-rc1 -...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-17508 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.85)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.85 and more Source cves: CVE-2026-17508 Source advisory: MEND:CVE-2026-17508...

com.github.fmjsjx:libnetty-example (>=3.7.2, <=3.8.0-rc1), com.github.manosbatsis.corbeans:corbeans-corda-webserver (>=0.26, <=0.30) +62 more potentially affected by CVE-2026-17508 via org.bouncycastle:bcpkix-lts8on (>=2.73.6, <=2.73.12)

org.bouncycastle:bcpkix-lts8on MAVEN version =2.73.6, =3.7.2, =0.26, =0.26, =0.26, =0.26, =0.0.9-snapshot, =4.1.1-patch-01, =0.0.9-snapshot, =4.12, =4.12, =7.0, =7.5 and more Source cves: CVE-2026-17508 Source advisory: MEND:CVE-2026-17508...

Beyond Predefined Sinks: Security-Aware Dependency Analysis for LLM Agents

Large language model LLM-based agents increasingly connect model-generated decisions to security-sensitive software capabilities such as command execution, filesystem access, network communication, browser control, and external tools. Existing analyses often use predefined sensitive operations as...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.6), ai.fastllm:agent-checkpoint-git_3 (>=0.3.0, <=0.5.6) +1822 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.19.0-rc2, <=2.21.5)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.19.0-rc2, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.9.0, =1.2.0 and more Source cves: CVE-2026-68495 Source advisory:...

@cotecna/stencil-components (>=3.0.0, <=3.2.1), @sumaris-net/ngx-components (18.5.0-alpha2) +2 more potentially affected by CVE-2026-103922 via @capacitor/android (>=6.0.0-nightly-20240307T150431.0, <=6.2.0)

@capacitor/android NPM version =6.0.0-nightly-20240307T150431.0, =3.0.0, =1.0.0, =1.0.0, =1.1.6 Source cves: CVE-2026-103922 Source advisory: MEND:CVE-2026-103922...

@cotecna/stencil-components (>=3.3.1, <=4.0.0), @happyknuckles/angular-standalone-clean-code (0.0.2) +3 more potentially affected by CVE-2026-103922 via @capacitor/android (>=7.0.1, <=7.4.4)

@capacitor/android NPM version =7.0.1, =3.3.1, =0.0.24, =1.0.1, =0.0.1, =0.0.2 Source cves: CVE-2026-103922 Source advisory: MEND:CVE-2026-103922...

@cotecna/stencil-components (>=3.3.1, <=4.0.0), @happyknuckles/angular-standalone-clean-code (0.0.2) +2 more potentially affected by CVE-2026-103922 via @capacitor/ios (>=7.0.1, <=7.4.4)

@capacitor/ios NPM version =7.0.1, =3.3.1, =0.0.24, =1.0.1, =1.8.0 Source cves: CVE-2026-103922 Source advisory: MEND:CVE-2026-103922...

aaa-ml-datasets-course (1.0.0), aerocm (0.1.0b0) +148 more potentially affected by CVE-2026-102904 via jupyterlab (>=4.0.0, <=4.5.8)

jupyterlab PYPI version =4.0.0, =0.5.5, =2.0.0, =4.33.0, =1.0.1, =0.1.0, =1.6.4b1, =0.0.1, =1.8.2, =0.0.1, =0.3.1, =0.1.0, =0.1.4 - cad-viewer-widget 3.0.2 and more Source cves: CVE-2026-102904 Source advisory: OSV:PYSEC-2026-4055...

a2 (>=0.1.0, <=0.6.1), aaa-ml-datasets-course (1.0.0) +575 more potentially affected by CVE-2026-102830 via jupyterlab (>=3.0.0, <=4.5.8)

jupyterlab PYPI version =3.0.0, =0.1.0, =0.1.0b0, =0.1.0b0, =0.1.0b0, =0.1.0, =0.5.5, =2.0.0, =0.1.1, =0.1.0, =3.0.0, =4.33.0, =5.0.0 - arcor2-calibration 0.8.0 and more Source cves: CVE-2026-102830 Source advisory: OSV:PYSEC-2026-4056...

pretix (>=4.17.0, <=4.17.1), providentia (2.4.0) potentially affected by CVE-2026-103000 via pypdf (3.4.1)

pypdf PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pretix =4.17.0, =4.17.1 - providentia 2.4.0 Source cves: CVE-2026-103000 Source advisory: OSV:PYSEC-2026-4160...

add-staves (>=0.1.1, <=0.2.4), agentix-agent-sdk (0.1.0) +137 more potentially affected by CVE-2026-102997 via pypdf (4.3.1)

pypdf PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - add-staves =0.1.1, =0.0.1, =0.0.1.dev1, =3.0.0, =0.1.0, =1.0.0, =0.3.8.0, =0.3.2, =0.1.6, =1725528079.0.0, =0.1.4, =0.1.9 and more Source cves:...

calibreweb (0.6.21), sysnet-pdffiller (>=1.1.0, <=1.2.1) potentially affected by CVE-2026-102997 via pypdf (3.15.5)

pypdf PYPI version 3.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.21 - sysnet-pdffiller =1.1.0, =1.2.1 Source cves: CVE-2026-102997 Source advisory: OSV:PYSEC-2026-4156...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-102999 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-102999 Source advisory: OSV:PYSEC-2026-4159...

indico (>=3.2.6, <=3.2.9) potentially affected by CVE-2026-103000 via pypdf (3.12.1)

pypdf PYPI version 3.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - indico =3.2.6, =3.2.9 Source cves: CVE-2026-103000 Source advisory: OSV:PYSEC-2026-4160...

krummstab (>=0.2.0, <=1.2.1) potentially affected by CVE-2026-103000 via pypdf (3.1.0)

pypdf PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - krummstab =0.2.0, =1.2.1 Source cves: CVE-2026-103000 Source advisory: OSV:PYSEC-2026-4160...