ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +23618 more potentially affected by CVE-2026-108106 via org.xerial.snappy:snappy-java (>=1.0.1-rc3, <=1.1.10.8)

org.xerial.snappy:snappy-java MAVEN version =1.0.1-rc3, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2026-108106 Source advisory: SNYK:JAVA-ORGXERIALSNAPPY-20825055...

Malicious Package

Overview media-manager5 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @galicia-toolkit-nestjs/paas is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @library-wide/library-shell is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview asepxyznew is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CLSA-2026-1791571542 TuxCare security update for @xmldom/xmldom (1 CVE)

TuxCare rebuilt @xmldom/xmldom to address 1 CVE. Fixed in 0.9.8-tuxcare.4...

@aws-amplify/amplify-category-api (>=5.8.0, <=5.15.7), @aws-amplify/amplify-container-hosting (>=2.6.0-ampgenconfig.0, <=2.8.27) +11 more potentially affected by CVE-2026-108096 via @aws-amplify/graphql-index-transformer (>=2.2.0, <=3.1.1)

@aws-amplify/graphql-index-transformer NPM version =2.2.0, =5.8.0, =2.6.0-ampgenconfig.0, =1.8.4-rc.2def814808.0, =11.0.0-ampgenconfig.0, =3.2.0, =0.1.1-raven.0, =2.2.0, =1.3.0, =0.1.0-alpha.0, =3.1.13-stack-limits.3, =2.5.4-beta.0, =2.5.4-cdkv2.3 - testtransformerlambda 1.0.0 Source cves:...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-JQ7H-WRVP-3RGX...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: GHSA-FR26-JJHM-638C...

MGASA-2026-0481 Updated openssl package fixes security vulnerabilities

DTLS Retransmits Handshake Messages From a Stale Buffer Offset. CVE-2026-84782 Excessive Memory Allocation in Relative CRLDP Processing. CVE-2026-35189 QUIC Unvalidated Amplification Credit may be Over Accounted. CVE-2026-35191 Potential CPU DoS via On^2 Fragment Reassembly in QUIC. CVE-2026-4277...

CVE-2026-108112 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/uuid. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete skips the...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +22420 more potentially affected by CVE-2026-108106 via org.xerial.snappy:snappy-java (>=1.0.5, <=1.1.10.8)

org.xerial.snappy:snappy-java MAVEN version =1.0.5, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2026-108106 Source advisory: MEND:CVE-2026-108106...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +77 more potentially affected by CVE-2026-107728 via strawberry-graphql (>=0.217.0, <=0.325.0)

strawberry-graphql PYPI version =0.217.0, =2025.4.0, =2025.4.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0, =25.13.0rc1, =1.2.0, =0.1.0a1, =0.2.0, =1.0.1, =2.2.1 - dictatorgenai 0.1.0 and more Source cves: CVE-2026-107728 Source advisory: GHSA-PFVF-FWFP-25MP...

Reusing a Nonce, Key Pair in Encryption

Overview Affected versions of this package are vulnerable to Reusing a Nonce, Key Pair in Encryption in the native one-shot CTR packet path ctrpcprocesspacket, which does not check that the request fits the addressable block range and reports the full input length as a success even once the block...

be.atbash.test:integration-testing (2.2.0), be.atbash.test:integration-testing-database (2.2.0) +896 more potentially affected by CVE-2026-78384 via org.apache.cxf:cxf-core (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-core MAVEN version =4.0.0, =1.0.0, =12.1-7-21, =0.0.1, =1.1.0, =2.70.0, =2.71.1 - com.codbex.kronos:codbex-kronos-commons 2.70.0 and more Source cves: CVE-2026-78384 Source advisory: SNYK:JAVA-ORGAPACHECXF-20824751...

CLSA-2026-1791549508 TuxCare security update for org.freemarker:freemarker (1 CVE)

TuxCare rebuilt org.freemarker:freemarker to address 1 CVE. Fixed in 2.3.34-tuxcare.1...

CLSA-2026-1791547948 TuxCare security update for io.projectreactor.netty (5 CVEs)

TuxCare rebuilt 4 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.0.48-tuxcare.5...

ROOT-OS-DEBIAN-13-CVE-2026-19445 CVE-2026-19445 in python3.13 - Patched by Root

Root has patched CVE-2026-19445 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-15366 CVE-2025-15366 in python3.13 - Patched by Root

Root has patched CVE-2025-15366 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

ipg (0.2.0), ipg-cng (>=0.1.1, <=0.1.2) potentially affected by unknown CVE via ic-cipher (0.2.7)

ic-cipher CARGO version 0.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on ic-cipher and may be impacted: - ipg 0.2.0 - ipg-cng =0.1.1, =0.1.2 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0337...