ai.timefold.solver:timefold-solver-migration (>=1.7.0, <=1.23.0), com.alibaba.fastjson2:fastjson2-extension-spring5 (>=2.0.43, <=2.0.58) +1084 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.16.0, <=2.18.9)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.16.0, =1.7.0, =2.0.43, =0.0.23, =0.0.2, =0.0.11, =1.0.0, =0.0.3, =0.0.3, =1.41.0, =1.49.1, =1.49.1, =1.50.6 and more Source cves: CVE-2026-68496 Source advisory: MEND:CVE-2026-68496...

com.erudika:para-search-elasticsearch (>=1.43.1, <=1.43.2), com.netflix.atlas_v1:atlas-chart_2.13 (>=1.9.0-rc.12, <=1.9.0-rc.20) +479 more potentially affected by CVE-2026-68496 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.2.0, =1.43.1, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.20 and mor...

com.erudika:para-search-elasticsearch (>=1.43.1, <=1.43.2), com.webauthn4j:webauthn4j-appattest (>=0.31.9.release, <=0.31.10.release) +393 more potentially affected by CVE-2026-68495 via tools.jackson.dataformat:jackson-dataformat-cbor (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-cbor MAVEN version =3.2.0, =1.43.1, =0.31.9.release, =0.31.9.release, =0.31.9.release, =0.31.9.release, =0.31.9.release, =0.31.9.release, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.2 and more Source cves:...

CLSA-2026-1790875447 TuxCare security update for org.springframework.integration (5 CVEs)

TuxCare rebuilt 39 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.16-tuxcare.1...

CVE-2023-54404 Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation

Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the...

agatta (>=1.0.0, <=1.0.2), agentbuddy (0.1.1.dev33) +102 more potentially affected by CVE-2026-102999 via pypdf (3.17.4)

pypdf PYPI version 3.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agatta =1.0.0, =0.0.3, =0.0.1, =1.1.0, =0.0.2, =1.2.0, =0.6.7, =1.2.1, =0.1.3, =0.0.1, =0.8.2 - cadenai 0.1.0 and more Source cves: CVE-2026-102999...

athena-starship (>=0.0.3, <=0.0.6), conflare (>=0.1.2, <=0.1.3) +11 more potentially affected by CVE-2026-102997 via pypdf (4.1.0)

pypdf PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - athena-starship =0.0.3, =0.1.2, =2.2.0, =3.3.0, =1.14.0, =0.1.4, =4.6.2, =0.1.0, =0.1.7 Source cves: CVE-2026-102997 Source advisory: OSV:PYSEC-2026-4...

smart-pdf (2023.9.11.1) potentially affected by CVE-2026-102999 via pypdf (3.16.0)

pypdf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - smart-pdf 2023.9.11.1 Source cves: CVE-2026-102999 Source advisory: OSV:PYSEC-2026-4159...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2026-102999 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2026-102999 Source...

pdfmerge (1.0.0), ribometric (>=0.1.4, <=0.1.12) potentially affected by CVE-2026-102999 via pypdf (3.9.0)

pypdf PYPI version 3.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pdfmerge 1.0.0 - ribometric =0.1.4, =0.1.12 Source cves: CVE-2026-102999 Source advisory: OSV:PYSEC-2026-4159...

agatta (>=1.0.0, <=1.0.2), agentbuddy (0.1.1.dev33) +102 more potentially affected by CVE-2026-103000 via pypdf (3.17.4)

pypdf PYPI version 3.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agatta =1.0.0, =0.0.3, =0.0.1, =1.1.0, =0.0.2, =1.2.0, =0.6.7, =1.2.1, =0.1.3, =0.0.1, =0.8.2 - cadenai 0.1.0 and more Source cves: CVE-2026-103000...

add-staves (>=0.1.1, <=0.2.4), agentix-agent-sdk (0.1.0) +137 more potentially affected by CVE-2026-103000 via pypdf (4.3.1)

pypdf PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - add-staves =0.1.1, =0.0.1, =0.0.1.dev1, =3.0.0, =0.1.0, =1.0.0, =0.3.8.0, =0.3.2, =0.1.6, =1725528079.0.0, =0.1.4, =0.1.9 and more Source cves:...

cocpyth (>=0.1.1, <=0.1.2), pretix (>=4.19.0, <=4.20.4) potentially affected by CVE-2026-102998 via pypdf (3.8.1)

pypdf PYPI version 3.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cocpyth =0.1.1, =4.19.0, =4.20.4 Source cves: CVE-2026-102998 Source advisory: OSV:PYSEC-2026-4157...

calibreweb (0.6.20) potentially affected by CVE-2026-102998 via pypdf (3.5.2)

pypdf PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.20 Source cves: CVE-2026-102998 Source advisory: OSV:PYSEC-2026-4157...

docat (1.0.0) potentially affected by CVE-2026-102998 via pypdf (4.0.0)

pypdf PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docat 1.0.0 Source cves: CVE-2026-102998 Source advisory: OSV:PYSEC-2026-4157...

calibreweb (0.6.20) potentially affected by CVE-2026-103000 via pypdf (3.5.2)

pypdf PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.20 Source cves: CVE-2026-103000 Source advisory: OSV:PYSEC-2026-4160...

5mghost-rover (>=0.0.1, <=0.0.3), ace-framework (>=0.6.0, <=0.7.3) +213 more potentially affected by CVE-2026-102998 via pypdf (>=6.0.0, <=6.18.1)

pypdf PYPI version =6.0.0, =0.0.1, =0.6.0, =0.1.0, =0.0.2, =0.1.0, =0.0.24, =0.0.0, =1.1.0, =0.1.2, =0.0.1.dev0, =1.0.0, =1.0.0a3, =1.0.0a4 and more Source cves: CVE-2026-102998 Source advisory: OSV:PYSEC-2026-4157...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-102997 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2026-102998 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2026-102998 Source...

docvec-cli (0.1.0), ingenious (>=0.1.0, <=0.1.3) +3 more potentially affected by CVE-2026-102998 via pypdf (5.5.0)

pypdf PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docvec-cli 0.1.0 - ingenious =0.1.0, =0.1.3b1, =0.2.6, =29.1.3, =30.0.4 Source cves: CVE-2026-102998 Source advisory: OSV:PYSEC-2026-4157...