CLSA-2026-1790868324 TuxCare security update for adm-zip (1 CVE)

TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.10-tuxcare.2...

cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +5 more potentially affected by CVE-2026-102904 via jupyterlab (>=4.6.0, <=4.6.2)

jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-102904 Source advisory: OSV:GHSA-3325-V43H-43RV...

ai.codriverlabs:scaleout-build-control-plane-api (0.0.1-centraltest), ai.codriverlabs:scaleout-build-ecs (0.0.1-centraltest) +12746 more potentially affected by CVE-2026-89425 via com.fasterxml.jackson.core:jackson-core (>=2.22.0, <=2.22.2)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.22.0, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.9, =0.9.6, =0.7.0, =0.9.3, =0.9.9, =0.7.0, =0.7.0, =0.9.8 and more Source cves: CVE-2026-89425 Source advisory: GHSA-7HHH-6RMP-J9QF...

ac.pao:reports-web (1.0.0), ai.aarvion:aarvion-spring-boot-starter (>=0.1.0, <=0.2.0) +37024 more potentially affected by CVE-2026-89425 via com.fasterxml.jackson.core:jackson-core (>=2.19.0, <=2.21.6)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.19.0, =0.1.0, =1.0.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.6 and more Source cves:...

ai.codriverlabs:scaleout-build-control-plane-api (0.0.1-centraltest), ai.codriverlabs:scaleout-build-ecs (0.0.1-centraltest) +12746 more potentially affected by CVE-2026-89407 via com.fasterxml.jackson.core:jackson-core (>=2.22.0, <=2.22.2)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.22.0, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.9, =0.9.6, =0.7.0, =0.9.3, =0.9.9, =0.7.0, =0.7.0, =0.9.8 and more Source cves: CVE-2026-89407 Source advisory: GHSA-P6PP-M3F8-5C89...

ac.pao:reports-java-engine (1.0.0), ae.alphapay:alphapay-gateway-client (2.0.0) +39645 more potentially affected by CVE-2026-89407 via com.fasterxml.jackson.core:jackson-core (>=2.17.0, <=2.18.10)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.17.0, =1.0.0, =1.0.0, =0.1.1, =0.1.0-rc4, =0.1.0-rc4, =0.1.3, =0.21.0-alpha.1, =0.24.0-alpha.2 and more Source cves: CVE-2026-89407 Source advisory: GHSA-P6PP-M3F8-5C89...

ac.pao:reports-web (1.0.0), ai.aarvion:aarvion-spring-boot-starter (>=0.1.0, <=0.2.0) +37024 more potentially affected by CVE-2026-89407 via com.fasterxml.jackson.core:jackson-core (>=2.19.0, <=2.21.6)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.19.0, =0.1.0, =1.0.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.6 and more Source cves:...

ai.codriverlabs:scaleout-build-control-plane-api (0.0.1-centraltest), ai.codriverlabs:scaleout-build-ecs (0.0.1-centraltest) +12746 more potentially affected by CVE-2026-89407 via com.fasterxml.jackson.core:jackson-core (>=2.22.0, <=2.22.2)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.22.0, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.9, =0.9.6, =0.7.0, =0.9.3, =0.9.9, =0.7.0, =0.7.0, =0.9.8 and more Source cves: CVE-2026-89407 Source advisory: OSV:GHSA-P6PP-M3F8-5C89...

@agent-harness-experimental/workflow (>=0.0.1, <=0.0.5), @ai_kit/workflow-world (>=0.1.0, <=0.2.0) +134 more potentially affected by unknown CVE via devalue (>=5.0.0, <=5.9.2)

devalue NPM version =5.0.0, =0.0.1, =0.1.0, =6.1.0, =6.1.0, =7.0.0, =6.1.0, =0.3.0, =0.0.0-dev.20251108074143, =4.2.3, =3.8.8, =3.8.8, =3.8.7, =3.8.7, =0.1.1, =4.3.15, =4.3.33 and more Source cves: unknown CVE Source advisory: OSV:GHSA-HX4R-W6WJ-J8FG...

@agent-harness-experimental/workflow (>=0.0.1, <=0.0.5), @ai_kit/workflow-world (>=0.1.0, <=0.2.0) +134 more potentially affected by unknown CVE via devalue (>=5.0.0, <=5.9.2)

devalue NPM version =5.0.0, =0.0.1, =0.1.0, =6.1.0, =6.1.0, =7.0.0, =6.1.0, =0.3.0, =0.0.0-dev.20251108074143, =4.2.3, =3.8.8, =3.8.8, =3.8.7, =3.8.7, =0.1.1, =4.3.15, =4.3.33 and more Source cves: unknown CVE Source advisory: GHSA-HX4R-W6WJ-J8FG...

@agent-harness-experimental/workflow (>=0.0.1, <=0.0.5), @ai_kit/workflow-world (>=0.1.0, <=0.2.0) +134 more potentially affected by unknown CVE via devalue (>=5.0.0, <=5.9.2)

devalue NPM version =5.0.0, =0.0.1, =0.1.0, =6.1.0, =6.1.0, =7.0.0, =6.1.0, =0.3.0, =0.0.0-dev.20251108074143, =4.2.3, =3.8.8, =3.8.8, =3.8.7, =3.8.7, =0.1.1, =4.3.15, =4.3.33 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MCM9-63F2-9J32...

@agent-harness-experimental/workflow (>=0.0.1, <=0.0.5), @ai_kit/workflow-world (>=0.1.0, <=0.2.0) +134 more potentially affected by unknown CVE via devalue (>=5.0.0, <=5.9.2)

devalue NPM version =5.0.0, =0.0.1, =0.1.0, =6.1.0, =6.1.0, =7.0.0, =6.1.0, =0.3.0, =0.0.0-dev.20251108074143, =4.2.3, =3.8.8, =3.8.8, =3.8.7, =3.8.7, =0.1.1, =4.3.15, =4.3.33 and more Source cves: unknown CVE Source advisory: SNYK:JS-DEVALUE-20416738...

GHSA-R9W8-H9R3-54W4 devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

Under very specific circumstances, parse could create massive ArrayBuffers with very small input. This required a malformed ArrayBuffer custom reviver...

b1ddi (0.0.2), delete-branches (>=1.0.0, <=1.1.3) +15 more potentially affected by CVE-2026-102925 via virtualenv (20.34.0)

virtualenv PYPI version 20.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - b1ddi 0.0.2 - delete-branches =1.0.0, =1.1.14, =1.0.0, =1.1.0, =1.17.0, =1.25.0 and more Source cves: CVE-2026-102925 Source advisory:...

cosmic-ray (>=6.1.1, <=8.3.5), fauxpy (>=0.1.0, <=0.7.0) +1 more potentially affected by CVE-2026-102925 via virtualenv (16.7.10)

virtualenv PYPI version 16.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cosmic-ray =6.1.1, =0.1.0, =0.7.0 - pickley 2.0.14 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

lftools (0.31.2) potentially affected by CVE-2026-102925 via virtualenv (20.0.9)

virtualenv PYPI version 20.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - lftools 0.31.2 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

middleware-apm (>=0.1.29, <=0.1.37) potentially affected by CVE-2026-102925 via virtualenv (20.0.17)

virtualenv PYPI version 20.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - middleware-apm =0.1.29, =0.1.37 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

mlproto (>=0.1.1, <=0.2.0) potentially affected by CVE-2026-102925 via virtualenv (20.0.27)

virtualenv PYPI version 20.0.27 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - mlproto =0.1.1, =0.2.0 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

titanic-mieuxqaloys (0.1.0) potentially affected by CVE-2026-102925 via virtualenv (20.29.2)

virtualenv PYPI version 20.29.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - titanic-mieuxqaloys 0.1.0 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

pokpok-sdk (>=0.1.3, <=0.1.6) potentially affected by CVE-2026-102925 via virtualenv (20.29.1)

virtualenv PYPI version 20.29.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pokpok-sdk =0.1.3, =0.1.6 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...