@agent-analytics/paperclip-live-analytics-plugin (>=0.1.1, <=0.1.11), @clawjedi/paperclip-plugin-chat (>=1.0.0, <=1.0.4) +16 more potentially affected by unknown CVE via @paperclipai/shared (>=2026.3.17-canary.0, <=2026.415.0-canary.7)

@paperclipai/shared NPM version =2026.3.17-canary.0, =0.1.1, =1.0.0, =0.0.1, =0.3.3, =0.1.0, =0.1.9, =2026.3.17-canary.0, =2026.3.17-canary.0, =2026.407.0-canary.5, =2026.3.17-canary.0, =2026.3.17-canary.2, =0.1.0, =2026.324.0-canary.0, =2026.325.0-canary.3 - corporateai 2026.328.0-canary.0 -...

Incorrect Authorization

Overview @clerk/shared is an Internal package utils used by the Clerk SDKs Affected versions of this package are vulnerable to Incorrect Authorization via the createPathMatcher function in @clerk/shared used by downstream createRouteMatcher. An attacker can gain unauthorized access to protected...

@clerk/agent-toolkit (>=0.2.9-canary.v20251211104600, <=0.3.14-snapshot.v20260414205636), @clerk/astro (>=3.0.0-canary.v20251211104600, <=3.0.14-snapshot.v20260414205636) +43 more potentially affected by CVE-2026-41248 via @clerk/shared (>=4.0.0, <=4.8.0-snapshot.v20260414205636)

@clerk/shared NPM version =4.0.0, =0.2.9-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-snapshot.v20251216175437, =3.0.0-canary.v20251211104600, =0.4.26-snapshot.v20260226165729, =2.0.0-canary.v20251211104600,...

@clerk/agent-toolkit (>=0.2.9-canary.v20251211104600, <=0.3.14-snapshot.v20260414205636), @clerk/astro (>=3.0.0-canary.v20251211104600, <=3.0.14-snapshot.v20260414205636) +43 more potentially affected by CVE-2026-41248 via @clerk/shared (>=4.0.0, <=4.8.0-snapshot.v20260414205636)

@clerk/shared NPM version =4.0.0, =0.2.9-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-snapshot.v20251216175437, =3.0.0-canary.v20251211104600, =0.4.26-snapshot.v20260226165729, =2.0.0-canary.v20251211104600,...

@aurora-nexus/aurora-nexus-design-system (0.2.0), @fireproof/core-protocols-dashboard (>=0.24.3-dev-20261224, <=0.24.12) +6 more potentially affected by CVE-2026-41248 via @clerk/shared (>=3.36.0, <=3.45.1)

@clerk/shared NPM version =3.36.0, =0.24.3-dev-20261224, =0.24.3-dev-20261224, =0.24.3-dev-20261224, =0.0.14, =0.18.25-dev, =0.24.3-dev-20261224, =0.18.25-dev, =0.18.28-dev Source cves: CVE-2026-41248 Source advisory: OSV:GHSA-VQX2-FGX2-5WQ9...

Malicious code in @3stripes/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ca39203b484afe25fca27596d3c3c81a0a6765ad88d3b129871375127bdb5ea The package @3stripes/shared was found to contain malicious code...

MAL-2026-2707 Malicious code in @3stripes/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ca39203b484afe25fca27596d3c3c81a0a6765ad88d3b129871375127bdb5ea The package @3stripes/shared was found to contain malicious code...

The vulnerability of the Brokering File System (BFS) in Windows operating systems allows a perpetrator to increase their privileges.

The vulnerability of the Brokering File System BFS in Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the Function Discovery service in Windows operating systems allows a perpetrator to increase their privileges.

The vulnerability of the Function Discovery service in Windows operating systems is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the Windows Push Notifications service allows a perpetrator to escalate their privileges.

The vulnerability of Windows push-notifications services is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow attackers to gain increased privileges...

The vulnerability of the Windows Push Notifications service allows a perpetrator to escalate their privileges.

The vulnerability of Windows push-notifications services is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow attackers to gain increased privileges...

The vulnerability of the Transport Driver Interface (TDI) driver in Windows operating systems allows attackers to escalate their privileges.

The vulnerability of the Transport Driver Interface TDI driver in Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain increased privileges...

The vulnerability of the Simple Search and Discovery Protocol (SSDP) service in the Windows operating system allows a hacker to increase their privileges.

The vulnerability of the Simple Search and Discovery Protocol SSDP service in the Windows operating system is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the Cloud Files Mini Filter driver for the Windows operating system allows a hacker to increase their privileges.

The vulnerability of the Cloud Files Mini Filter driver for the Windows operating system is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain increased privileges...

CVE-2026-2336: Insufficient Entropy

A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own webstaxauth session cookie and forge a new cookie with administrative privileges.This issue affects IStaX before 2026.03...

Microchip IStaX 安全漏洞

Microchip IStaX is a Ethernet switch software development platform developed by Microchip Corporation in the United States. Versions of Microchip IStaX prior to version 2026.03 contained security vulnerabilities. These vulnerabilities were caused by the exposure of the cookie key for shared...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cups (UTSA-2026-007170)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007170 advisory. OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a...

The vulnerability of the Windows Management Services management tool allows attackers to increase their privileges.

The vulnerability of the Windows Management Services management tool in Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow attackers to increase their privileges...

CVE-2026-33827

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows TCP/IP allows an unauthorized attacker to execute code over a network...

CVE-2026-32091

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally...