io.github.ilyaslabs.foodstack:configserver (=0.0.1), io.github.ilyaslabs:spring-boot-microservice-config-server (=1.0.0) +7 more potentially affected by CVE-2026-41004 via org.springframework.cloud:spring-cloud-config-server (>=4.3.0 <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.3.0, =1.0.1, =7.3.0, =7.3.0, =26.01.01, =2.3.0, =4.3.0, =3.3.0, =3.3.2 Source cves: CVE-2026-41004 Source advisory: OSV:GHSA-J6HH-H3CF-C2HF...

async-std-resolver (>=0.25.0-alpha.1 <=0.25.0-alpha.5), ezk-sip-ua (>=0.5.0 <=0.7.1) +3 more potentially affected by unknown CVE via hickory-proto (=0.25.0-alpha.5)

hickory-proto CARGO version =0.25.0-alpha.5 is affected by a known vulnerability. The following packages have a transitive dependency on hickory-proto and may be impacted: - async-std-resolver =0.25.0-alpha.1, =0.5.0, =0.25.0-alpha.1, =0.25.0-alpha.5 - hickory-resolver =0.25.0-alpha.1 Source cves...

@caliperai/caliper (>=0.2.0 <=0.3.0), @doccov/api (>=0.6.0 <=0.6.4) +12 more potentially affected by CVE-2026-44479 via vercel (>=50.41.0 <=51.8.0)

vercel NPM version =50.41.0, =0.2.0, =0.6.0, =0.3.0-rc.2, =3.10.3, =1.1.1, =1.0.1, =1.0.2, =0.1.19, =0.4.0-rc.3, =1.0.0, =2.0.0 Source cves: CVE-2026-44479 Source advisory: OSV:GHSA-PGF8-2HGJ-GRQG...

@vrabbi/backstage-devtools-wrapper (>=0.2.0 <=0.2.1) potentially affected by CVE-2026-44374 via @backstage/plugin-catalog-unprocessed-entities (=0.1.4)

@backstage/plugin-catalog-unprocessed-entities NPM version =0.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-catalog-unprocessed-entities and may be impacted: - @vrabbi/backstage-devtools-wrapper =0.2.0, =0.2.1 Source cves:...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: trivy-operator-fips, flux-image-automation-controller-fips, grype-fips, melange, grafana, kaniko-fips, gitlab-rails-ce, argo-workflows-fips, flux-source-controller-fips, google-osconfig-agent, pulumi-language-java, jfrog-cli, pulumi-language-yaml, grype, trivy-fips,...

de.digitalcollections.cudami:dc-cudami-server-backend-jdbi (>=6.0.0 <=8.0.3-RC1), de.digitalcollections.cudami:dc-cudami-server-webapp (>=6.0.0 <=6.2.3) +2 more potentially affected by unknown CVE via org.jdbi:jdbi3-freemarker (>=3.30.0 <=3.52.0)

org.jdbi:jdbi3-freemarker MAVEN version =3.30.0, =6.0.0, =6.0.0, =9.0.0, =3.49.4, =3.52.0 Source cves: unknown CVE Source advisory: OSV:GHSA-MGGX-P7JF-JGW4...

01runmodel (>=1.0.3 <=1.0.4), 1405-authtokens (>=1.0.1 <=1.0.5) +9303 more potentially affected by CVE-2026-42334 via mongoose (>=1.0.0 <=6.13.8)

mongoose NPM version =1.0.0, =1.0.3, =1.0.1, =1.0.0, =1.0.0, =1.0.7, =0.0.1, =0.0.2, =0.3.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-42334 Source advisory: OSV:GHSA-WPG9-53FQ-2R8H...

@b3dotfun/b3-api (>=0.0.42 <=0.0.102), @b3dotfun/sdk (>=0.0.27-alpha.1 <=0.1.70-alpha.12) +38 more potentially affected by CVE-2026-42047 via inngest (>=3.22.13 <=3.47.0)

inngest NPM version =3.22.13, =0.0.42, =0.0.27-alpha.1, =1.0.4, =0.0.26, =2.0.5, =0.0.3-canary.1, =0.1.2, =1.0.1-alpha.0, =1.0.1-alpha.0, =1.0.1-alpha.0, =1.0.1-alpha.0, =0.1.13, =1.0.1-alpha.0, =0.0.1, =1.0.1, =1.0.4-alpha.13 and more Source cves: CVE-2026-42047 Source advisory:...

arthexis (>=0.2.6 <=0.8.0), cg-django-uaa (=2.1.9) +29 more potentially affected by CVE-2026-35192 via django (>=5.2.0 <=5.2.13)

django PYPI version =5.2.0, =0.2.6, =0.1.0, =0.1.0, =1.3.0, =1.92.0.5, =4.2.0, =0.0.7, =3.0.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-35192 Source advisory: OSV:PYSEC-2026-50...

eldenring-util (>=0.1.1 <=0.11.0), luminol-result (=0.4.0) +3 more potentially affected by unknown CVE via steamworks (>=0.10.0 <=0.12.2)

steamworks CARGO version =0.10.0, =0.1.1, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0121...

@514labs/aurora-mcp (>=0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939 <=0.0.64), @514labs/sloan-mcp (=0.0.65) +488 more potentially affected by CVE-2026-43870 via thrift (>=0.10.0 <=0.22.0)

thrift NPM version =0.10.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.6, =0.9.0, =0.0.0-9d773c, =0.0.0-5ad901, =0.0.1, =1.0.0-beta.1, =1.0.0-beta.6, =1.0.1, =1.1.0, =0.24.0-no-protobuf-patch.1, =0.24.0-patch.1 - @ccmaymay/concrete =4.15.1 and more Source cves: CVE-2026-43870...

best.skn:skn-spring-mail (>=1.0.0 <=2.4.0), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=7.0.0 <=8.8.1) +755 more potentially affected by CVE-2026-41901 via org.thymeleaf:thymeleaf-spring6 (>=3.1.0.M1 <=3.1.4.RELEASE)

org.thymeleaf:thymeleaf-spring6 MAVEN version =3.1.0.M1, =1.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.6.0, =7.6.0, =7.0.0, =7.0.0, =8.8.1 and more Source cves: CVE-2026-41901 Source advisory: OSV:GHSA-C9PH-GXWW-7744...

ae.teletronics.nlp:entityextraction (=1.3), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0 <=0.2.0) +1738 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (>=1.5.2-incubating <=2.5.8)

org.apache.opennlp:opennlp-tools MAVEN version =1.5.2-incubating, =0.1.0, =0.1.0, =2.12.1, =2.12.1, =19.9.0, =19.9.1, =19.9.1, =19.9.0, =19.9.0, =19.9.0, =19.9.0, =26.3.2 and more Source cves: CVE-2026-42440 Source advisory: OSV:GHSA-659W-93R5-9J6M...

xhci (>=0.2.6 <=0.9.2) potentially affected by unknown CVE via accessor (>=0.2.0 <=0.3.3)

accessor CARGO version =0.2.0, =0.2.6, =0.9.2 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0127...

ai.h2o:sparkling-water-core_2.11 (>=3.46.0.1-1-2.3 <=3.46.0.6-1-2.4), ai.h2o:sparkling-water-core_2.12 (>=3.46.0.1-1-3.0 <=3.46.0.6-1-3.5) +762 more potentially affected by CVE-2026-42778 via org.apache.mina:mina-core (>=2.2.0 <=2.2.6)

org.apache.mina:mina-core MAVEN version =2.2.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =1.5.4.RELEASE, =0.0.2, =3.0.0, =1.0.9, =1.6.9, =1.2.5, =1.1.7, =1.2.8 and more Source cves: CVE-2026-42778 Sourc...

annatar (>=0.4.3 <=0.5.8), ansi2png-rs (>=0.1.0 <=0.1.1) +62 more potentially affected by unknown CVE via imageproc (>=0.10.0 <=0.22.0)

imageproc CARGO version =0.10.0, =0.4.3, =0.1.0, =0.2.0, =0.1.5, =0.1.0, =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.1.0, =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0117...

@unhook/cli (>=0.8.0 <=0.15.0) potentially affected by CVE-2026-42349 via @clerk/express (>=1.5.0 <=1.7.63)

@clerk/express NPM version =1.5.0, =0.8.0, =0.15.0 Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

armature-diesel (=0.1.0), authzen-diesel (=0.1.0-alpha.0) +13 more potentially affected by unknown CVE via diesel-async (>=0.1.1 <=0.5.2)

diesel-async CARGO version =0.1.1, =0.1.0, =0.17.0, =0.17.0, =0.17.0, =0.11.0, =0.0.1, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0138...

@regis-samurai/n8n (>=0.216.1 <=0.219.1), n8n-nodes-accelo (>=0.1.0 <=0.1.9) +11 more potentially affected by CVE-2026-42230 via n8n (>=0.138.0 <=0.93.0)

n8n NPM version =0.138.0, =0.216.1, =0.1.0, =0.18.0, =0.1.0, =0.1.0, =0.2.14, =0.1.0, =0.1.0, =0.0.2, =0.0.2, =1.1.3 Source cves: CVE-2026-42230 Source advisory: OSV:GHSA-F6X8-65Q6-J9M9...

beetcamp (>=0.18.0 <=0.19.3), beets-alternatives (>=0.11.0 <=0.11.1) +12 more potentially affected by CVE-2026-42052 via beets (>=1.4.9 <=2.0.0)

beets PYPI version =1.4.9, =0.18.0, =0.11.0, =0.3.1, =0.1.0, =1.1.3, =0.1.1, =0.2.0, =0.1.1, =0.4.0 - musicbot =0.9.0 Source cves: CVE-2026-42052 Source advisory: OSV:GHSA-3GXM-WFJX-M847...