bolinette (>=0.6.11, <=0.7.6), cvexplore (>=0.1.3, <=0.1.6) +14 more potentially affected by CVE-2026-96749 via pymongo (3.11.2)

pymongo PYPI version 3.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - bolinette =0.6.11, =0.1.3, =0.0.1, =0.0.3, =1.1.0b1, =1.0.2, =1.1.2, =0.0.2, =0.0.6 - scrapy-plus 1.0.5 and more Source cves: CVE-2026-96749 Sour...

academic-metrics (>=0.1.0b0, <=1.0.99), accomate (>=1.0.4, <=2.0.0.6) +808 more potentially affected by CVE-2026-96749 via pymongo (>=4.0.0, <=4.18.1)

pymongo PYPI version =4.0.0, =0.1.0b0, =1.0.4, =0.9.0, =0.3.0, =0.1.0, =0.1.23, =0.22.0, =0.3.0, =0.2.0, =0.1.0, =0.8.1 - aind-metadata-mapper 0.12.4 - aind-metadata-mcp 0.1.0 and more Source cves: CVE-2026-96749 Source advisory: OSV:GHSA-V4X9-3549-CRWV...

restart-mongo (>=0.1.0, <=0.1.4) potentially affected by CVE-2026-96749 via pymongo (2.7.2)

pymongo PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - restart-mongo =0.1.0, =0.1.4 Source cves: CVE-2026-96749 Source advisory: OSV:GHSA-V4X9-3549-CRWV...

2d6io-cryptobot (0.0.1), almanac-bot (>=0.3.1, <=0.3.2) +19 more potentially affected by CVE-2026-96749 via pymongo (3.5.1)

pymongo PYPI version 3.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - 2d6io-cryptobot 0.0.1 - almanac-bot =0.3.1, =0.1.5, =0.1.2a0, =1.1.0, =0.4.11, =1.3.9, =0.43.0, =1.0.0, =1.0.4, =13.0.0, =11.1.0, =0.1.0, =1.0.1,...

amoniak (1.0.2), aws-scripts (>=0.0.20, <=0.1.12) +6 more potentially affected by CVE-2026-96749 via pymongo (2.9.5)

pymongo PYPI version 2.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - amoniak 1.0.2 - aws-scripts =0.0.20, =0.4.2, =2.0.3, =0.1.3, =2.0.0, =2.3.0 Source cves: CVE-2026-96749 Source advisory: OSV:GHSA-V4X9-3549-CRWV...

general-tools (>=0.1.4, <=0.2.1), happymongo-py3 (0.1.2) +3 more potentially affected by CVE-2026-96749 via pymongo (3.7.0)

pymongo PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - general-tools =0.1.4, =0.1.0, =23.0.3, =23.0.7 Source cves: CVE-2026-96749 Source advisory: OSV:GHSA-V4X9-3549-CRWV...

afs2-datasource (>=3.6.0, <=3.8.2), amanzi-orca (>=0.5.2, <=0.5.3) +23 more potentially affected by CVE-2026-96749 via pymongo (3.7.2)

pymongo PYPI version 3.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - afs2-datasource =3.6.0, =0.5.2, =1.1.0rc1, =0.0.2.dev1, =0.0.4, =0.5.0, =1.0.8a5, =0.2.1, =0.0.1, =0.0.1, =4.0.9, =0.0.3, =0.0.13 and more Source...

quokka (>=0.0.1.dev84, <=0.4.1.dev22) potentially affected by CVE-2026-96749 via pymongo (2.4.1)

pymongo PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - quokka =0.0.1.dev84, =0.4.1.dev22 Source cves: CVE-2026-96749 Source advisory: OSV:GHSA-V4X9-3549-CRWV...

aleph-alpha-inference (1.0.0), evoke-vllm (>=0.1.0, <=0.1.1) +6 more potentially affected by CVE-2026-105758 via vllm (>=0.24.0, <=0.29.0)

vllm PYPI version =0.24.0, =0.1.0, =2.9.0, =2.3.0, =0.1.10, =0.1.0, =0.1.4 Source cves: CVE-2026-105758 Source advisory: OSV:GHSA-X6MC-67GF-CHW4...

adoc (>=0.1.0, <=0.1.5), adr (>=0.4.0, <=0.5.0) +317 more potentially affected by CVE-2026-102991 via mako (>=1.0.1, <=1.4.1)

mako PYPI version =1.0.1, =0.1.0, =0.4.0, =0.1.0rc3, =2022.9.19, =1.1.0, =2.0.0b1, =0.0.4rc1, =0.0.0, =0.1.0.dev1, =5.2.15, =5.3.33 and more Source cves: CVE-2026-102991 Source advisory: OSV:GHSA-5639-2J2P-M4MX...

adoc (>=0.1.0, <=0.1.5), adr (>=0.4.0, <=0.5.0) +317 more potentially affected by CVE-2026-102991 +1 more via mako (>=1.0.1, <=1.4.1)

mako PYPI version =1.0.1, =0.1.0, =0.4.0, =0.1.0rc3, =2022.9.19, =1.1.0, =2.0.0b1, =0.0.4rc1, =0.0.0, =0.1.0.dev1, =5.2.15, =5.3.33 and more Source cves: CVE-2026-102991, CVE-2026-41205 Source advisory: GHSA-5639-2J2P-M4MX...

@0xsequence/codegenie (>=0.1.0, <=0.7.0), @2h2d/new (>=0.0.2, <=0.1.1-alpha.4) +963 more potentially affected by unknown CVE via smol-toml (>=1.1.2, <=1.8.0)

smol-toml NPM version =1.1.2, =0.1.0, =0.0.2, =0.1.0, =1.0.0, =0.1.0, =4.10.0, =0.1.3, =0.1.0-beta.1, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-R4XH-JQRQ-34V2...

EUVD-2026-90979

KaTeX: Existing prototype pollution can bypass trust restrictions...

abe-bft (1.0.0), adversarial-workflow (>=0.4.0, <=0.9.8) +408 more potentially affected by CVE-2026-104874 via multidict (>=6.7.0, <=6.8.0)

multidict PYPI version =6.7.0, =0.4.0, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =0.1.0, =1.0.5, =25.11.0, =0.7.0, =0.7.1 and more Source cves: CVE-2026-104874 Source advisory: OSV:GHSA-54P9-H82J-F925...

abe-bft (1.0.0), adversarial-workflow (>=0.4.0, <=0.9.8) +408 more potentially affected by CVE-2026-104874 via multidict (>=6.7.0, <=6.8.0)

multidict PYPI version =6.7.0, =0.4.0, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =0.1.0, =1.0.5, =25.11.0, =0.7.0, =0.7.1 and more Source cves: CVE-2026-104874 Source advisory: GHSA-54P9-H82J-F925...

@a-r-m-i-n/opencode-openai-usage (>=0.1.0, <=0.1.1), @aexol/opencode-tui (>=0.2.4, <=0.4.1) +450 more potentially affected by CVE-2026-104846 via seroval (>=0.12.4, <=1.6.0)

seroval NPM version =0.12.4, =0.1.0, =0.2.4, =0.1.2, =0.0.6, =1.20.47, =0.3.0, =0.1.0, =0.13.0, =2.11.0, =1.0.2, =1.0.0, =0.0.1, =0.6.3 and more Source cves: CVE-2026-104846 Source advisory: GHSA-P6VX-979V-RG4C...

CVE-2026-104712

Apache Struts can produce a response many orders of magnitude larger than the request when an attacker-controlled request parameter is bound to a java.math.BigDecimal property and that property is rendered through the Struts tag library. An unauthenticated remote attacker can use sustained,...

@aws/nx-plugin (>=1.0.0-rc.24, <=1.0.0-rc.87), @brabander/config-eslint (>=0.1.1, <=0.5.3) +173 more potentially affected by CVE-2026-104854 via nx (>=23.0.0, <=23.1.1)

nx NPM version =23.0.0, =1.0.0-rc.24, =0.1.1, =1.0.0-alpha.0, =0.3.1, =1.0.0-rc.39, =0.0.2-10, =1.1.0-alpha.3, =0.20.2, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.1.1 and more Source cves: CVE-2026-104854 Source advisory: OSV:GHSA-W3VV-58GJ-GW77...

mongodb-migrations (0.1.1), rolabesti (>=0.1.0, <=0.5.3) potentially affected by CVE-2026-88029 via pymongo (3.2.1)

pymongo PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - mongodb-migrations 0.1.1 - rolabesti =0.1.0, =0.5.3 Source cves: CVE-2026-88029 Source advisory: OSV:GHSA-8FVV-FGR5-F8CH...

mongoext (>=0.2.0, <=0.2.3), mongoops (>=0.0.1, <=1.0.1) potentially affected by CVE-2026-88029 via pymongo (2.8.0)

pymongo PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - mongoext =0.2.0, =0.0.1, =1.0.1 Source cves: CVE-2026-88029 Source advisory: OSV:GHSA-8FVV-FGR5-F8CH...