@cloudcommerce/storefront (>=0.10.0, <=0.11.0), @gspenst/next (>=0.1.0, <=0.1.2) +6 more potentially affected by CVE-2026-108261 via @tinacms/app (>=0.0.0-a0a8cb3-20260817041004, <=2.5.12)

@tinacms/app NPM version =0.0.0-a0a8cb3-20260817041004, =0.10.0, =0.1.0, =0.1.0, =0.0.0-20220819182845, =0.0.2, =0.0.3, =0.1.1, =0.1.3 - ramidus 1.2.1 Source cves: CVE-2026-108261 Source advisory: MEND:CVE-2026-108261...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +23663 more potentially affected by CVE-2026-108104 via org.xerial.snappy:snappy-java (>=1.0.1-rc3, <=1.1.10.8)

org.xerial.snappy:snappy-java MAVEN version =1.0.1-rc3, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2026-108104 Source advisory: SNYK:JAVA-ORGXERIALSNAPPY-20825056...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +23663 more potentially affected by CVE-2026-108106 via org.xerial.snappy:snappy-java (>=1.0.1-rc3, <=1.1.10.8)

org.xerial.snappy:snappy-java MAVEN version =1.0.1-rc3, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2026-108106 Source advisory: SNYK:JAVA-ORGXERIALSNAPPY-20825055...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.2, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.2, <=0.1.0-alpha.4) +34581 more potentially affected by CVE-2026-102554 via com.google.guava:guava (>=33.0.0-android, <=33.7.1-jre)

com.google.guava:guava MAVEN version =33.0.0-android, =0.1.0-alpha.2, =0.1.0-alpha.2, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.2, =0.1.0-alpha.2, =0.1.0-alpha.2, =0.1.0-alpha.2, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.21.0-alpha.2, =0.1.1, =0.104.0 and more Source...

Malicious Package

Overview @library-wide/library-shell is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @galicia-toolkit-nestjs/paas is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview asepxyznew is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview media-manager5 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CLSA-2026-1791571542 TuxCare security update for @xmldom/xmldom (1 CVE)

TuxCare rebuilt @xmldom/xmldom to address 1 CVE. Fixed in 0.9.8-tuxcare.4...

@aws-amplify/amplify-category-api (>=5.8.0, <=5.15.7), @aws-amplify/amplify-container-hosting (>=2.6.0-ampgenconfig.0, <=2.8.27) +13 more potentially affected by CVE-2026-108096 via @aws-amplify/graphql-index-transformer (>=2.2.0, <=3.1.1)

@aws-amplify/graphql-index-transformer NPM version =2.2.0, =5.8.0, =2.6.0-ampgenconfig.0, =1.8.4-rc.2def814808.0, =11.0.0-ampgenconfig.0, =3.2.0, =0.1.1-raven.0, =2.2.0, =1.3.0, =0.1.0-alpha.0, =3.1.13-stack-limits.3, =2.5.4-beta.0, =2.5.4-cdkv2.3 - testtransformerlambda 1.0.0 Source cves:...

CLSA-2026-1791569293 freerdp: Fix of 6 CVEs

CVE-2026-91953, CVE-2026-91964: bound every write in negosendnegotiationrequest with StreamEnsureRemainingCapacity; the routing token taken from the server's LBLOADBALANCEINFO was written into a fixed 512 byte stream unchecked, overflowing the heap allocation - CVE-2026-91963: allocate wStream...

CLSA-2026-1791568721 freerdp: Fix of 6 CVEs

CVE-2026-91953, CVE-2026-91964: bound every write in negosendnegotiationrequest with StreamEnsureRemainingCapacity; the routing token taken from the server's LBLOADBALANCEINFO was written into a fixed 512 byte stream unchecked, overflowing the heap allocation - CVE-2026-91963: allocate wStream...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-JQ7H-WRVP-3RGX...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: GHSA-FR26-JJHM-638C...

MGASA-2026-0481 Updated openssl package fixes security vulnerabilities

DTLS Retransmits Handshake Messages From a Stale Buffer Offset. CVE-2026-84782 Excessive Memory Allocation in Relative CRLDP Processing. CVE-2026-35189 QUIC Unvalidated Amplification Credit may be Over Accounted. CVE-2026-35191 Potential CPU DoS via On^2 Fragment Reassembly in QUIC. CVE-2026-4277...

CLSA-2026-1791563836 ipa: Fix of 4 CVEs

CVE-2026-73197: limit the request body size of the unauthenticated migration endpoint - CVE-2026-73198: limit the request body size of the unauthenticated i18nmessages endpoint - CVE-2026-76578: harden default ACIs and permissions against unauthenticated and delegated privilege escalation -...

CVE-2026-108112 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/uuid. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete skips the...

CLSA-2026-1791558283 Fix CVE(s): CVE-2026-16118

SECURITY UPDATE: heap buffer overflow when byte-swapping MIME magic values on little-endian systems - debian/patches/CVE-2026-16118.patch: fix pointer arithmetic on the write side of the byte swap in xdgmimemagicparsemagicline - CVE-2026-16118...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +22465 more potentially affected by CVE-2026-108106 via org.xerial.snappy:snappy-java (>=1.0.5, <=1.1.10.8)

org.xerial.snappy:snappy-java MAVEN version =1.0.5, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2026-108106 Source advisory: MEND:CVE-2026-108106...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +36 more potentially affected by CVE-2026-107727 via strawberry-graphql (>=0.312.4, <=0.327.1)

strawberry-graphql PYPI version =0.312.4, =2025.4.0, =2025.4.0, =1.0.0, =0.9.0, =26.4.0rc1, =0.1.0a1, =0.2.0, =1.0.1, =0.1.0, =1.17.0, =0.1.0, =0.0.246, =2.0.0, =0.0.1a0, =0.1.26, =0.1.32 and more Source cves: CVE-2026-107727 Source advisory: SNYK:PYTHON-STRAWBERRYGRAPHQL-20823901...