kartykgithub-ph-f-dep (1.0.0) potentially affected by unknown CVE via kartykgithub-ph-f (1.0.0)

kartykgithub-ph-f NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on kartykgithub-ph-f and may be impacted: - kartykgithub-ph-f-dep 1.0.0 Source cves: unknown CVE Source advisory: SNYK:JS-KARTYKGITHUBPHF-20385969...

CLSA-2026-1790933443 openssl: Fix of 2 CVEs

CVE-2026-84782: dtls: reset initoff before retransmitting a message, and skip retransmission while a handshake write is still suspended - CVE-2026-35189: defer computation of relative CRL distribution point names until CRL processing actually needs them...

CLSA-2026-1790933161 openssl: Fix of 2 CVEs

CVE-2026-84782: reset s-initoff to 0 in dtls1retransmitmessage and skip retransmission in dtls1handletimeout while a handshake write is suspended, preventing a DTLS retransmit from being sent from a stale buffer offset - CVE-2026-35189: defer building the full nameRelativeToCRLIssuer distribution...

com.ascentstream.pulsar:bcfips-include-test (>=2.10.6.9, <=3.0.8.0-snapshot-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=2.10.6.9, <=3.0.14.1) +20 more potentially affected by CVE-2026-17508 via org.bouncycastle:bcpkix-fips (>=1.0.1, <=1.0.12)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.1, =2.10.6.9, =2.10.6.9, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =1.0.0, =1.0.0, =3.0.0-rc1, =3.0.0-rc6, =1.0.0, =1.0.1 - io.skuber:skuber-examples2.12 2.6.3 - io.skuber:skuber-examples2.13 2.6.3 and more Source cves: CVE-2026-17508 Source advisor...

ai.h2o:sparkling-water-core_2.11 (>=3.46.0.1-1-2.3, <=3.46.0.6-1-2.4), ai.h2o:sparkling-water-core_2.12 (>=3.46.0.1-1-3.0, <=3.46.0.6-1-3.5) +600 more potentially affected by CVE-2026-102731 via org.apache.directory.api:api-asn1-ber (>=2.1.0, <=2.1.8)

org.apache.directory.api:api-asn1-ber MAVEN version =2.1.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =2.0.20, =4.0.2 - com.google.appengine:appengine-local-runtime-jetty12 2.0.23 -...

be.personify.iam:personify-provisioning (>=1.3.1.release, <=1.5.8.release), be.personify.iam:personify-scim-server (>=1.2.6.release, <=2.1.2.release) +31 more potentially affected by CVE-2026-102731 via org.apache.directory.api:api-all (>=2.1.0, <=2.1.8)

org.apache.directory.api:api-all MAVEN version =2.1.0, =1.3.1.release, =1.2.6.release, =3.0.0, =1.0.9, =1.6.9, =1.2.5, =1.1.7, =0.8.2, =1.2.15, =1.0.10, =4.3.2, =4.1.16, =4.1.17, =4.1.17, =4.4.5 and more Source cves: CVE-2026-102731 Source advisory: MEND:CVE-2026-102731...

Improper Handling of Length Parameter Inconsistency

Overview Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency in the handling of length parameters in the Lua bindings. An attacker can cause excessive resource allocation by sending requests with inconsistent length parameters, potentially...

CLSA-2026-1790929139 TuxCare security update for h11 (1 CVE)

TuxCare rebuilt h11 to address 1 CVE. Fixed in 0.12.0.post1+tuxcare...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +19695 more potentially affected by CVE-2026-18036 via org.bouncycastle:bcprov-jdk18on (>=1.72, <=1.85)

org.bouncycastle:bcprov-jdk18on MAVEN version =1.72, =0.2.0, =0.9.3, =0.4.0, =0.9.4, =0.9.7, =0.8.0, =0.8.0, =0.9.6, =0.6.0, =0.9.3, =0.4.0, =0.4.0, =0.9.8 and more Source cves: CVE-2026-18036 Source advisory: MEND:CVE-2026-18036...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.8.0), com.pkixops:pkixops-crypto (1.5.2) +165 more potentially affected by CVE-2026-17508 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.56.0 and more Source cves: CVE-2026-17508 Source advisory: MEND:CVE-2026-17508...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +20083 more potentially affected by CVE-2026-17508 via org.bouncycastle:bcprov-jdk18on (>=1.71, <=1.85.2)

org.bouncycastle:bcprov-jdk18on MAVEN version =1.71, =0.2.0, =0.9.3, =0.4.0, =0.9.4, =0.9.7, =0.8.0, =0.8.0, =0.9.6, =0.6.0, =0.9.3, =0.4.0, =0.4.0, =0.9.8 and more Source cves: CVE-2026-17508 Source advisory: MEND:CVE-2026-17508...

app.cash.trifle:common (>=0.2.9, <=0.2.10), app.cash.trifle:jvm (>=0.2.8, <=0.2.10) +908 more potentially affected by CVE-2026-17508 via org.bouncycastle:bcpkix-jdk15to18 (>=1.71, <=1.85)

org.bouncycastle:bcpkix-jdk15to18 MAVEN version =1.71, =0.2.9, =0.2.8, =0.2.8, =0.2.8, =1.0.1-rc14, =3.5.0.0, =2.6.4, =2.6.4, =2.6.4, =2.6.4, =2.6.4, =0.1.1, =0.1.1, =0.1.1, =0.1.4.2 and more Source cves: CVE-2026-17508 Source advisory: MEND:CVE-2026-17508...

com.github.fmjsjx:libnetty-example (>=3.7.2, <=3.8.0-rc1), com.github.manosbatsis.corbeans:corbeans-corda-webserver (>=0.26, <=0.30) +62 more potentially affected by CVE-2026-17508 via org.bouncycastle:bcpkix-lts8on (>=2.73.6, <=2.73.12)

org.bouncycastle:bcpkix-lts8on MAVEN version =2.73.6, =3.7.2, =0.26, =0.26, =0.26, =0.26, =0.0.9-snapshot, =4.1.1-patch-01, =0.0.9-snapshot, =4.12, =4.12, =7.0, =7.5 and more Source cves: CVE-2026-17508 Source advisory: MEND:CVE-2026-17508...

org.bouncycastle:bcjmail-debug-jdk15to18 (>=1.81, <=1.85), org.bouncycastle:bcmail-debug-jdk15to18 (>=1.81, <=1.85) +4 more potentially affected by CVE-2026-17508 via org.bouncycastle:bcprov-debug-jdk15to18 (>=1.81, <=1.85.1)

org.bouncycastle:bcprov-debug-jdk15to18 MAVEN version =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.85.1 Source cves: CVE-2026-17508 Source advisory: MEND:CVE-2026-17508...

CVE-2026-85016 Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...

CVE-2026-85016 Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...

kartykgithub-ph-dep (1.0.0) potentially affected by unknown CVE via kartykgithub-ph-b (1.0.0)

kartykgithub-ph-b NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on kartykgithub-ph-b and may be impacted: - kartykgithub-ph-dep 1.0.0 Source cves: unknown CVE Source advisory: OSV:MAL-2026-17424...

CLEANSTART-2026-ED72933 html

Security vulnerability affects the consul package. The html...

CLEANSTART-2026-RW00799 Security fix for GHSA-f6x5-jh6r-wrfv applied in: consul 1.21.5-r0

Security vulnerability affects the consul package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-PU41775 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

CVE-2026-34986 affects multiple packages. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See references for individual vulnerability...