async-std-resolver (>=0.24.0, <=0.25.0-alpha.5), futures-dnsv2 (>=0.2.6, <=0.2.8) +1 more potentially affected by unknown CVE via hickory-proto (>=0.24.4, <=0.25.0-alpha.5)

hickory-proto CARGO version =0.24.4, =0.24.0, =0.2.6, =0.24.0, =0.25.0-alpha.1 Source cves: unknown CVE Source advisory: OSV:GHSA-Q2QQ-HMJ6-3WPP...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, crossplane, snyk-cli, goreleaser, grafana-alloy, kots, pulumi-language-dotnet, src-fingerprint-fips, commercial-chainloop-cli, terragrunt, terragrunt-fips, osv-scanner, kubevela-fips, pulumi-kubernetes-operator, witness, jfrog-cli, chainloop-cli-fips...

@0xchain/empty (>=0.0.1, <=1.1.0-beta.4), @0xchain/expandable-text (>=0.0.1, <=1.1.0-beta.18) +15 more potentially affected by unknown CVE via next-intl (>=4.0.2, <=4.9.1)

next-intl NPM version =4.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.8.0, =1.28.0, =0.0.3, =1.4.88, =1.5.37 and more Source cves: unknown CVE Source advisory: OSV:GHSA-4C35-WCG5-MM9H...

endringer (>=0.1.0, <=0.7.1) potentially affected by CVE-2026-82251 via gix (0.0.0)

gix CARGO version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on gix and may be impacted: - endringer =0.1.0, =0.7.1 Source cves: CVE-2026-82251 Source advisory: OSV:GHSA-FR8X-3VFX-F45H...

endringer (>=0.1.0, <=0.7.1) potentially affected by CVE-2026-82252 via gix (0.0.0)

gix CARGO version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on gix and may be impacted: - endringer =0.1.0, =0.7.1 Source cves: CVE-2026-82252 Source advisory: OSV:GHSA-PG4W-G64P-QWHJ...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +15813 more potentially affected by CVE-2026-42041 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42041 Source advisory: OSV:GHSA-W9J2-PVGH-6H63...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +15873 more potentially affected by CVE-2026-42044 via axios (>=1.0.0, <=1.15.1)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42044 Source advisory: OSV:GHSA-3W6X-2G7M-8V23...

@aaasd/pocpoc (99.99.9996), internal-company-module-test-1337 (>=99.99.9991, <=99.99.9995) potentially affected by unknown CVE via internal-company-module-test-1337 (99.99.9996)

internal-company-module-test-1337 NPM version 99.99.9996 is affected by a known vulnerability. The following packages have a transitive dependency on internal-company-module-test-1337 and may be impacted: - @aaasd/pocpoc 99.99.9996 - internal-company-module-test-1337 =99.99.9991, =99.99.9995 Sour...

accesskit_consumer (>=0.1.0, <=0.7.1), accesskit_windows (>=0.1.0, <=0.8.0) +798 more potentially affected by unknown CVE via sized-chunks (>=0.1.3, <=0.6.5)

sized-chunks CARGO version =0.1.3, =0.1.0, =0.1.0, =0.1.0, =1.0.5, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =1.15.0, =1.15.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0251...

xhci (>=0.2.6, <=0.9.2) potentially affected by unknown CVE via accessor (>=0.2.0, <=0.3.3)

accessor CARGO version =0.2.0, =0.2.6, =0.9.2 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0127...

ansi2png-rs (>=0.1.0, <=0.1.1), artano (>=0.1.0, <=0.3.5) +55 more potentially affected by unknown CVE via imageproc (>=0.6.1, <=0.22.0)

imageproc CARGO version =0.6.1, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1 - img2text 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0117...

ansi2png-rs (>=0.1.0, <=0.1.1), artano (>=0.1.0, <=0.3.5) +55 more potentially affected by unknown CVE via imageproc (>=0.6.1, <=0.22.0)

imageproc CARGO version =0.6.1, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1 - img2text 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0116...

@budibase/cli (>=3.0.0, <=3.2.26), @budibase/pro (>=3.0.0, <=3.2.26) +2 more potentially affected by CVE-2026-42239 via @budibase/backend-core (>=3.0.0, <=3.2.26)

@budibase/backend-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-42239 Source advisory: OSV:GHSA-4F9J-VR4P-642R...

SecScan

SecScan Local-LLM-powered security scanner for GitHub repos...

@chocolatey-software/astro (2.7.0) potentially affected by CVE-2026-41322 via @astrojs/node (10.0.4)

@astrojs/node NPM version 10.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on @astrojs/node and may be impacted: - @chocolatey-software/astro 2.7.0 Source cves: CVE-2026-41322 Source advisory: OSV:GHSA-C57F-MM3J-27Q9...

ach (>=0.1.0, <=0.2.5), ach-array (>=0.1.0, <=0.2.5) +1666 more potentially affected by unknown CVE via bare-metal (>=0.1.3, <=1.0.0)

bare-metal CARGO version =0.1.3, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.5.0, =0.5.0, =0.8.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0110...

@accounter/modern-poalim-scraper (0.10.1-alpha-20250905202854-1612dbe0853c5d6e9f9ddff402868250fa642e59), @aleph-alpha/lib-http (1.4.5) +14 more potentially affected by CVE-2026-41907 +1 more via uuid (12.0.0)

uuid NPM version 12.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on uuid and may be impacted: - @accounter/modern-poalim-scraper 0.10.1-alpha-20250905202854-1612dbe0853c5d6e9f9ddff402868250fa642e59 - @aleph-alpha/lib-http 1.4.5 -...

@deviceinsight/ng-ui-scale-lib (>=10.0.0, <=10.1.0), locizify (>=6.1.0, <=9.0.9) +1 more potentially affected by CVE-2026-41886 via locize (>=4.0.0, <=4.0.16)

locize NPM version =4.0.0, =10.0.0, =6.1.0, =1.1.11, =2.0.6 Source cves: CVE-2026-41886 Source advisory: OSV:GHSA-W937-FG2H-XHQ2...

2c2p-integration (>=0.2.0, <=0.2.2), 4help-shared (>=1.0.8, <=1.0.15) +4391 more potentially affected by CVE-2026-41672 via @xmldom/xmldom (>=0.7.0, <=0.8.12)

@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =1.0.4, =1.0.0, =2.1.0-develop-2ff6c7-mckmjkzz, =0.0.1, =0.0.2 - @abcd19/st-grid 3.1.0 and more Source cves: CVE-2026-41672 Source advisory: OSV:GHSA-J759-J44W-7FR8...

OSV-2026-599 UNKNOWN READ in XRef::parseEntry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=504271260 Crash type: UNKNOWN READ Crash state: XRef::parseEntry XRef::getEntry Parser::makeStream...