GO-2023-2334 vulnerabilities

Vulnerabilities for packages: spire-server-fips, tkn, fulcio, kubescape, falcoctl-fips, flux-source-controller, oauth2-proxy, kots, timestamp-authority-fips, vexctl, cosign-fips, gitsign, dex, flux-kustomize-controller, aactl, tekton-chains, terragrunt, fulcio-fips, bank-vaults-fips, spire-server...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +55 more potentially affected by CVE-2026-71320 via nuxt (>=3.4.2, <=3.21.8)

nuxt NPM version =3.4.2, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =1.12.0-rc.7 and more Source cves: CVE-2026-71320 Source advisory: SNYK:JS-NUXT-18565115...

@cafeai/cafe-code (0.0.28), @echomem/mcp (>=1.4.2, <=1.4.34) +10 more potentially affected by CVE-2026-70606 via electron (>=41.0.3, <=41.7.1)

electron NPM version =41.0.3, =1.4.2, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70606 Source advisory: OSV:GHSA-R4W5-6PFG-JXP5...

@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70605 via electron (>=40.0.0, <=40.8.5)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70605 Source advisory: SNYK:JS-ELECTRON-18563326...

Linux Distros Unpatched Vulnerability : CVE-2026-62941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check...

@aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.5), @aaravpos/appointment-booking-plugin (>=1.0.1, <=7.0.6) +271 more potentially affected by unknown CVE via react-router (>=7.12.0, <=7.18.1)

react-router NPM version =7.12.0, =1.0.0, =1.0.1, =0.0.9-alpha-20260107202750-16b04dcbaa92c7fc2bbb580dbc1da723c76a5225, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source...

@darthcav/ts-http-server (0.9.1), @digitalpaws/starr (0.0.2) +4 more potentially affected by CVE-2026-7120 via @fastify/static (10.1.0)

@fastify/static NPM version 10.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/static and may be impacted: - @darthcav/ts-http-server 0.9.1 - @digitalpaws/starr 0.0.2 - @node-cli/static-server =3.1.17, =9.0.0-canary.19, =9.0.2 Source cves:...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +1102 more potentially affected by unknown CVE via tar (>=7.0.0, <=7.5.20)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =1.6.0, =1.1.0, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =2026.4.17 and more Source cves: unknown CVE Source advisory: SNYK:JS-TAR-18319500...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +54 more potentially affected by CVE-2026-73419 via next-auth (>=4.0.0-beta.6, <=4.24.13)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: CVE-2026-73419 Source advisory: OSV:GHSA-X445-F3H2-J279...

@blumintinc/eslint-plugin-blumint (>=1.3.0, <=1.20.158), @eeacms/volto-cca-policy (>=0.1.17, <=0.2.22) +35 more potentially affected by CVE-2026-15699 via compromise (>=14.0.0, <=14.15.1)

compromise NPM version =14.0.0, =1.3.0, =0.1.17, =1.1.236, =0.1.1, =1.0.12, =4.0.2, =0.1.16, =0.1.14, =0.1.3, =0.1.29, =3.0.1, =0.1.0, =3.0.3, =0.1.4, =2.0.0-alpha.1, =2.2.0 and more Source cves: CVE-2026-15699 Source advisory: SNYK:JS-COMPROMISE-17972425...

@0xwork/connect (>=0.1.0, <=0.1.9), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +30 more potentially affected by CVE-2026-62188 via openclaw (>=2026.3.22, <=2026.6.6)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =1.1.50, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =2026.4.3-2 and more Source cves: CVE-2026-62188 Source advisory: SNYK:JS-OPENCLAW-17966765...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple packages which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor Component uses next-15.5.14.tgz, tomcat-embed-core-10.1.54.jar, systeminformation-5.31.4.tgz, jackson-core-2.19.2.jar, jackson-core-2.19.4.jar, jackson-core-2.20.0.jar, jackson-core-2.21.0.jar which are vulnerable to CVE-2026-44572, CVE-2026-44573,...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +21936 more potentially affected by CVE-2026-53486 via decompress (>=4.0.0, <=4.2.1)

decompress NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.0, =2.2.0-alpha.3 and more Source cves: CVE-2026-53486 Source advisory: OSV:GHSA-MP2F-45PM-3CG9...

Linux Distros Unpatched Vulnerability : CVE-2026-14383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HT...

Linux Distros Unpatched Vulnerability : CVE-2026-55958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsipStoreMessage the capacity check guarding the fixed message bag MSGBAGSIZE sets an erro...

Linux Distros Unpatched Vulnerability : CVE-2026-6092

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When HAVEENCRYPTTHENMAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC. CVE-2026-6092 Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-53179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix buffer over-read in rtwupdateprotection rtwupdateprotection is called with a pointer offset into the ies buffer but the full ielength is...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: external-secrets-operator, istio, rootlesskit, snyk-cli, wolfictl, helm, buildah, apko, docker-cli-buildx, buildkitd, gptscript, openbao, gomplate, zot, dagger, melange, telegraf, ksops, falcoctl, kubernetes, opentofu, atlantis, kubernetes-dashboard, minio,...

@3ngram/server (0.7.0), @compeso/node-red-contrib-imap-email (1.0.0) +8 more potentially affected by unknown CVE via nodemailer (9.0.0)

nodemailer NPM version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nodemailer and may be impacted: - @3ngram/server 0.7.0 - @compeso/node-red-contrib-imap-email 1.0.0 - @hybridaione/hybridclaw =0.25.3, =2.71.0, =2.72.0 - imapflow 1.4.1 -...

@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +20 more potentially affected by CVE-2026-54265 via @angular/compiler (>=21.0.0, <=21.2.16)

@angular/compiler NPM version =21.0.0, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =1.0.0, =4.4.0-beta.2, =1.0.77-rc.1, =0.0.1, =0.2.0, =1.3.2 and more Source cves: CVE-2026-54265 Source advisory: SNYK:JS-ANGULARCOMPILER-17356585...