Linux Distros Unpatched Vulnerability : CVE-2026-31842

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs....

Missing Report of Error Condition

Overview github.com/sigstore/cosign/cmd/cosign/cli/verify is a package that aims to make signatures invisible infrastructure. Affected versions of this package are vulnerable to Missing Report of Error Condition in the verify-blob-attestation module when used without --check-claims flag. An...

GHSA-C427-H43C-VF67 vulnerabilities

Vulnerabilities for packages: checkov, kubeflow-pipelines-visualization-server, open-webui, airflow, py3-cassandra-medusa, kserve, dask-kubernetes...

CVE-2026-25541 affecting package rust for versions less than 1.90.0-6

CVE-2026-25541 affecting package rust for versions less than 1.90.0-6. A patched version of the package is available...

Linux Distros Unpatched Vulnerability : CVE-2026-34601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41362 +1 more via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41362, CVE-2026-41402 Source advisory: SNYK:JS-OPENCLAW-15897787...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (0.8.3-beta.1) +11 more potentially affected by CVE-2026-41361 via openclaw (>=2026.3.22, <=2026.3.24-beta.2)

openclaw NPM version =2026.3.22, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-41361 Source advisory: OSV:GHSA-G86V-F9QV-RH6M...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (0.8.3-beta.1) +10 more potentially affected by CVE-2026-35642 via openclaw (>=2026.3.22, <=2026.3.24)

openclaw NPM version =2026.3.22, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-35642 Source advisory: OSV:GHSA-MW7W-G3MG-XQM7...

GHSA-46XP-26XH-HPQH vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester...

GHSA-9XRJ-H377-FR87 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.4-rails, ruby3.2-rails...

Linux Distros Unpatched Vulnerability : CVE-2026-33347

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an...

Embedded Malicious Code

Overview @emilgroup/partner-sdk is an A new version of the package Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM...

Malicious code in internal-api-insights (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b02a86affbdb1f89c5fff800bc1a2c78125d1536f84ed7caa8507f14d0ebf5c The package internal-api-insights was found to contain malicious code...

@advancedco/design-system-workspace (4.0.0), @agilie/widget-template (>=1.0.2, <=1.1.6) +885 more potentially affected by CVE-2026-32635 via @angular/compiler (>=17.0.0-next.3, <=18.2.14)

@angular/compiler NPM version =17.0.0-next.3, =1.0.2, =0.0.0, =1.0.0, =1.0.0, =0.0.1, =0.2.2, =1.0.0, =0.0.55, =1.0.0, =0.1.1, =0.1.0, =0.1.0, =0.1.3 and more Source cves: CVE-2026-32635 Source advisory: OSV:GHSA-G93W-MFHG-P222...

@apollo/composition (>=2.10.0-alpha.0, <=2.10.4), @apollo/gateway (>=2.10.0-alpha.0, <=2.10.4) +6 more potentially affected by CVE-2026-32621 via @apollo/federation-internals (>=2.10.0, <=2.10.4)

@apollo/federation-internals NPM version =2.10.0, =2.10.0-alpha.0, =2.10.0-alpha.0, =2.10.0-alpha.0, =2.10.0-alpha.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory:...

CVE-2025-58190 affecting package gh for versions less than 2.62.0-13

CVE-2025-58190 affecting package gh for versions less than 2.62.0-13. A patched version of the package is available...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview django-unicorn is an A magical full-stack framework for Django. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via unvalidated attribute access within the action parsers that fail to enforce visibility...

Linux Distros Unpatched Vulnerability : CVE-2026-31802

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar npm can be tricked into creating a symlink that points outside the extraction director...

PYSEC-2026-121

pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the editpackage function implements insufficient sanitization for the packfolder parameter. The current protection relies on a single-pass string replacement of "../", which can be...

GHSA-HFPC-8R3F-GW53 vulnerabilities

Vulnerabilities for packages: rustup, py3-xet-core, linkerd2, nushell, parseable, pixi, rustls-ffi, buck2, zellij, zizmor, uv, linkerd-extension-init, deno, lychee, linkerd-network-validator, cargo-audit, ntpd-rs, ztunnel, efs-utils, zed, linkerd2-proxy...