CVE-2026-41988

uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue...

@accounter/modern-poalim-scraper (0.10.1-alpha-20250905202854-1612dbe0853c5d6e9f9ddff402868250fa642e59), @aleph-alpha/lib-http (1.4.5) +14 more potentially affected by CVE-2026-41907 +1 more via uuid (12.0.0)

uuid NPM version 12.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on uuid and may be impacted: - @accounter/modern-poalim-scraper 0.10.1-alpha-20250905202854-1612dbe0853c5d6e9f9ddff402868250fa642e59 - @aleph-alpha/lib-http 1.4.5 -...

@0xpolygonid/js-sdk (>=1.32.1, <=1.34.0), @142vip/common (>=0.0.1-alpha.9, <=0.0.1-alpha.15) +2927 more potentially affected by CVE-2026-41907 +1 more via uuid (>=11.0.0-0, <=11.1.0)

uuid NPM version =11.0.0-0, =1.32.1, =0.0.1-alpha.9, =0.0.3-alpha.1, =0.1.6-alpha.9, =0.0.1-alpha.0, =1.0.0-alpha.20, =2.16.1, =1.0.0-alpha.34, =0.1.0-alpha.1, =1.0.0, =0.24.1-20230627140514, =0.25.1-20250326172337, =0.24.1-20230627140514, =0.24.1-20231019080841 and more Source cves:...

@0xpolygonid/js-sdk (>=1.32.1, <=1.34.0), @142vip/common (>=0.0.1-alpha.9, <=0.0.1-alpha.15) +2927 more potentially affected by CVE-2026-41907 via uuid (>=11.0.0-0, <=11.1.0)

uuid NPM version =11.0.0-0, =1.32.1, =0.0.1-alpha.9, =0.0.3-alpha.1, =0.1.6-alpha.9, =0.0.1-alpha.0, =1.0.0-alpha.20, =2.16.1, =1.0.0-alpha.34, =0.1.0-alpha.1, =1.0.0, =0.24.1-20230627140514, =0.25.1-20250326172337, =0.24.1-20230627140514, =0.24.1-20231019080841 and more Source cves: CVE-2026-419...

5w-logger (1.0.0), @0xpolygonid/js-kms-key-provider-lit-protocol (>=1.0.0, <=1.0.4) +734 more potentially affected by CVE-2026-41907 +1 more via uuid (13.0.0)

uuid NPM version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on uuid and may be impacted: - 5w-logger 1.0.0 - @0xpolygonid/js-kms-key-provider-lit-protocol =1.0.0, =1.35.0, =2.0.26,...

5w-logger (1.0.0), @0xpolygonid/js-kms-key-provider-lit-protocol (>=1.0.0, <=1.0.4) +734 more potentially affected by CVE-2026-41907 via uuid (13.0.0)

uuid NPM version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on uuid and may be impacted: - 5w-logger 1.0.0 - @0xpolygonid/js-kms-key-provider-lit-protocol =1.0.0, =1.35.0, =2.0.26,...

@accounter/modern-poalim-scraper (0.10.1-alpha-20250905202854-1612dbe0853c5d6e9f9ddff402868250fa642e59), @aleph-alpha/lib-http (1.4.5) +14 more potentially affected by CVE-2026-41907 via uuid (12.0.0)

uuid NPM version 12.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on uuid and may be impacted: - @accounter/modern-poalim-scraper 0.10.1-alpha-20250905202854-1612dbe0853c5d6e9f9ddff402868250fa642e59 - @aleph-alpha/lib-http 1.4.5 -...

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Summary The v3, v5, and v6 API methods not uuid release versions accept external output buffers but do not reject out-of-range writes small buf or large offset. By contrast, v4, v1, and v7 API methods explicitly throw RangeError on invalid bounds. This inconsistency allows silent partial writes...

@0xpolygonid/js-sdk (>=1.32.1, <=1.34.0), @142vip/common (>=0.0.1-alpha.9, <=0.0.1-alpha.15) +2927 more potentially affected by CVE-2026-41907 via uuid (>=11.0.0-0, <=11.1.0)

uuid NPM version =11.0.0-0, =1.32.1, =0.0.1-alpha.9, =0.0.3-alpha.1, =0.1.6-alpha.9, =0.0.1-alpha.0, =1.0.0-alpha.20, =2.16.1, =1.0.0-alpha.34, =0.1.0-alpha.1, =1.0.0, =0.24.1-20230627140514, =0.25.1-20250326172337, =0.24.1-20230627140514, =0.24.1-20231019080841 and more Source cves: CVE-2026-419...

Improper Validation of Specified Index, Position, or Offset in Input

Overview uuid is a RFC4122 v1, v4, and v5 compliant UUID library. Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input due to accepting external output buffers but not rejecting out-of-range writes small buf or large offset. This...

Improper Validation of Specified Index, Position, or Offset in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input due to accepting external output buffers but not rejecting out-of-range writes small buf or large offset. This inconsistency allows silent partial writes into...

1router (>=0.3.96, <=1.0.2), 3d-bin-packing-ts (>=1.0.0, <=1.0.1) +7828 more potentially affected by CVE-2026-41907 via uuid (>=12.0.0, <=13.0.2)

uuid NPM version =12.0.0, =0.3.96, =1.0.0, =2.1.0, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =0.0.1, =0.3.0, =0.4.0, =0.2.0, =0.2.1 and more Source cves: CVE-2026-41907 Source advisory: SNYK:JS-UUID-16133035...

CVE-2026-33212: Improper Access Control

Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. The attacker needs to brute-force the random UUID of the task, so...

CVE-2026-39419

MaxKB (enterprise open-source AI assistant)

CVE-2026-35412

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint /files/tus allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only...

Malware in strapi-plugin-advanced-uuid

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

SUSE CVE-2026-31410

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use volume UUID in FSOBJECTIDINFORMATION Use sb-suuid for a proper volume identifier as the primary choice. For filesystems that do not provide a UUID, fall back to stfs.ffsid obtained from vfsstatfs...

CVE-2026-35412

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint /files/tus allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only...

EUVD-2026-19194

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use volume UUID in FSOBJECTIDINFORMATION Use sb-suuid for a proper volume identifier as the primary choice. For filesystems that do not provide a UUID, fall back to stfs.ffsid obtained from vfsstatfs...

CVE-2026-31410

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use volume UUID in FSOBJECTIDINFORMATION Use sb-suuid for a proper volume identifier as the primary choice. For filesystems that do not provide a UUID, fall back to stfs.ffsid obtained from vfsstatfs...