Malicious Package

Overview @library-wide/library-shell is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @galicia-toolkit-nestjs/paas is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview media-manager5 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CLSA-2026-1791571542 TuxCare security update for @xmldom/xmldom (1 CVE)

TuxCare rebuilt @xmldom/xmldom to address 1 CVE. Fixed in 0.9.8-tuxcare.4...

@aws-amplify/amplify-category-api (>=5.8.0, <=5.15.7), @aws-amplify/amplify-container-hosting (>=2.6.0-ampgenconfig.0, <=2.8.27) +11 more potentially affected by CVE-2026-108096 via @aws-amplify/graphql-index-transformer (>=2.2.0, <=3.1.1)

@aws-amplify/graphql-index-transformer NPM version =2.2.0, =5.8.0, =2.6.0-ampgenconfig.0, =1.8.4-rc.2def814808.0, =11.0.0-ampgenconfig.0, =3.2.0, =0.1.1-raven.0, =2.2.0, =1.3.0, =0.1.0-alpha.0, =3.1.13-stack-limits.3, =2.5.4-beta.0, =2.5.4-cdkv2.3 - testtransformerlambda 1.0.0 Source cves:...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-JQ7H-WRVP-3RGX...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: GHSA-FR26-JJHM-638C...

MGASA-2026-0481 Updated openssl package fixes security vulnerabilities

DTLS Retransmits Handshake Messages From a Stale Buffer Offset. CVE-2026-84782 Excessive Memory Allocation in Relative CRLDP Processing. CVE-2026-35189 QUIC Unvalidated Amplification Credit may be Over Accounted. CVE-2026-35191 Potential CPU DoS via On^2 Fragment Reassembly in QUIC. CVE-2026-4277...

CVE-2026-108112 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/uuid. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete skips the...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +22420 more potentially affected by CVE-2026-108106 via org.xerial.snappy:snappy-java (>=1.0.5, <=1.1.10.8)

org.xerial.snappy:snappy-java MAVEN version =1.0.5, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2026-108106 Source advisory: MEND:CVE-2026-108106...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +77 more potentially affected by CVE-2026-107728 via strawberry-graphql (>=0.217.0, <=0.325.0)

strawberry-graphql PYPI version =0.217.0, =2025.4.0, =2025.4.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0, =25.13.0rc1, =1.2.0, =0.1.0a1, =0.2.0, =1.0.1, =2.2.1 - dictatorgenai 0.1.0 and more Source cves: CVE-2026-107728 Source advisory: GHSA-PFVF-FWFP-25MP...

Reusing a Nonce, Key Pair in Encryption

Overview Affected versions of this package are vulnerable to Reusing a Nonce, Key Pair in Encryption in the native one-shot CTR packet path ctrpcprocesspacket, which does not check that the request fits the addressable block range and reports the full input length as a success even once the block...

be.atbash.test:integration-testing (2.2.0), be.atbash.test:integration-testing-database (2.2.0) +896 more potentially affected by CVE-2026-78384 via org.apache.cxf:cxf-core (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-core MAVEN version =4.0.0, =1.0.0, =12.1-7-21, =0.0.1, =1.1.0, =2.70.0, =2.71.1 - com.codbex.kronos:codbex-kronos-commons 2.70.0 and more Source cves: CVE-2026-78384 Source advisory: SNYK:JAVA-ORGAPACHECXF-20824751...

CLSA-2026-1791549508 TuxCare security update for org.freemarker:freemarker (1 CVE)

TuxCare rebuilt org.freemarker:freemarker to address 1 CVE. Fixed in 2.3.34-tuxcare.1...

CLSA-2026-1791547948 TuxCare security update for io.projectreactor.netty (5 CVEs)

TuxCare rebuilt 4 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.0.48-tuxcare.5...

ROOT-OS-DEBIAN-13-CVE-2025-15366 CVE-2025-15366 in python3.13 - Patched by Root

Root has patched CVE-2025-15366 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-19445 CVE-2026-19445 in python3.13 - Patched by Root

Root has patched CVE-2026-19445 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

ipg (0.2.0), ipg-cng (>=0.1.1, <=0.1.2) potentially affected by unknown CVE via ic-cipher (0.2.7)

ic-cipher CARGO version 0.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on ic-cipher and may be impacted: - ipg 0.2.0 - ipg-cng =0.1.1, =0.1.2 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0337...

BIT-THRIFT-2026-94645 Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94639 Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)

improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...