io.github.zoom-dustin-moriarty:zoom-data-fence (1.0.0), net.snowflake:snowflake-ingest-sdk (>=4.0.1-unshaded, <=4.1.0-unshaded) +1 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc-thin (3.24.2)

net.snowflake:snowflake-jdbc-thin MAVEN version 3.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc-thin and may be impacted: - io.github.zoom-dustin-moriarty:zoom-data-fence 1.0.0 - net.snowflake:snowflake-ingest-sdk...

meta-g (>=1.0.0, <=1.0.494998), metag-sdk-ionic (>=1.0.0, <=1.1.6) potentially affected by CVE-2026-103922 via @capacitor/ios (6.1.2)

@capacitor/ios NPM version 6.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on @capacitor/ios and may be impacted: - meta-g =1.0.0, =1.0.0, =1.1.6 Source cves: CVE-2026-103922 Source advisory: GHSA-RVM3-566M-V7FV...

@sumaris-net/ngx-components (18.5.0-alpha2), meta-g (>=1.0.0, <=1.0.494998) +1 more potentially affected by CVE-2026-103922 via @capacitor/android (>=6.1.2, <=6.2.0)

@capacitor/android NPM version =6.1.2, =1.0.0, =1.0.0, =1.1.6 Source cves: CVE-2026-103922 Source advisory: OSV:GHSA-RVM3-566M-V7FV...

meta-g (>=1.0.0, <=1.0.494998), metag-sdk-ionic (>=1.0.0, <=1.1.6) potentially affected by CVE-2026-103922 via @capacitor/ios (6.1.2)

@capacitor/ios NPM version 6.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on @capacitor/ios and may be impacted: - meta-g =1.0.0, =1.0.0, =1.1.6 Source cves: CVE-2026-103922 Source advisory: OSV:GHSA-RVM3-566M-V7FV...

@sumaris-net/ngx-components (18.5.0-alpha2), meta-g (>=1.0.0, <=1.0.494998) +1 more potentially affected by CVE-2026-103922 via @capacitor/android (>=6.1.2, <=6.2.0)

@capacitor/android NPM version =6.1.2, =1.0.0, =1.0.0, =1.1.6 Source cves: CVE-2026-103922 Source advisory: GHSA-RVM3-566M-V7FV...

EUVD-2026-91794

LangGraph SDK custom auth silently ignores actions= on resource decorators...

a2a-client-handler (0.1.0), abs-langchain-suite (>=0.1.5, <=0.3.1) +470 more potentially affected by CVE-2026-104873 via langgraph-sdk (>=0.1.48, <=0.4.3)

langgraph-sdk PYPI version =0.1.48, =0.1.5, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.0.1a0, =2.1.7, =0.0.2, =0.1.1, =0.1.0, =0.2.0a1, =0.2.5a2, =1.1.0 and more Source cves: CVE-2026-104873 Source advisory: OSV:GHSA-FVWW-7H3R-VFHP...

a2a-client-handler (0.1.0), abs-langchain-suite (>=0.1.5, <=0.3.1) +470 more potentially affected by CVE-2026-104873 via langgraph-sdk (>=0.1.48, <=0.4.3)

langgraph-sdk PYPI version =0.1.48, =0.1.5, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.0.1a0, =2.1.7, =0.0.2, =0.1.1, =0.1.0, =0.2.0a1, =0.2.5a2, =1.1.0 and more Source cves: CVE-2026-104873 Source advisory: GHSA-FVWW-7H3R-VFHP...

GHSA-FVWW-7H3R-VFHP LangGraph SDK custom auth silently ignores actions= on resource decorators

Impact What kind of vulnerability is it? Who is impacted? langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons. In affected versions, a decorator such as: python...

LangGraph SDK custom auth silently ignores actions= on resource decorators

Impact What kind of vulnerability is it? Who is impacted? langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons. In affected versions, a decorator such as: python...

CVE-2026-92931

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...

EUVD-2026-92430

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...

CVE-2026-92931 CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...

CVE-2026-92931

The @progress/sitefinity-nextjs-sdk npm package (versions 15.1.8326 through 15.4.8637 ) is vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918). This flaw may allow a remote attacker to force the server to make requests to an attacker-controlled host , which could lead to the exposure of ...

CVE-2026-92931 CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit SDK to deploy a botnet malware called Cling. "Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinar...

Astra Linux – Vulnerability in Thunderbird

matrix-js-sdk is a client-server SDK for the Matrix messaging protocol, designed for JavaScript. Version 34.11.0 and earlier of matrix-js-sdk was vulnerable to client-side path traversal attacks through crafted MXC URIs. A malicious room member could trigger clients using matrix-js-sdk to send...

CVE-2026-92931: Server-Side Request Forgery (SSRF)

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...

PT-2026-105993

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...

MAL-2026-17472 Malicious code in anthropic-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 500869e36b3f76202b63e8db9087adcfc42c8281a27a4402a21285aabde7a511 The package publishes as anthropic-sdk and re-exports the official anthropic client's symbols from anthropic import ; re-exports of...