CLEANSTART-2026-OI46313 Security fixes in az 2.83.0-r3

Package az version 2.83.0-r3 fixes 1 vulnerabilities: ghsa-537c-gmf6-5ccf...

CLEANSTART-2026-AA71310 Security fixes in spire-server-fips 1.14.5-r0

Package spire-server-fips version 1.14.5-r0 fixes 3 vulnerabilities: CVE-2026-33816, ghsa-xmrv-pmrh-hhx2, CVE-2026-34986...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2026-44907 via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.0.4, =2.0.3-next.0 an...

@adobe/aem-cli (>=16.21.1, <=16.21.6), @adobe/helix-docx2md (>=1.9.29, <=1.9.31) +105 more potentially affected by CVE-2026-73643 via js-yaml (>=5.0.0, <=5.2.1)

js-yaml NPM version =5.0.0, =16.21.1, =1.9.29, =6.29.8, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =0.0.1-alpha.0, =1.0.8, =0.1.2, =0.11.0, =5.7.5, =7.0.2 - @davidsneighbour/markdownlint-config 2026.0.5 - @depup/nestjsswagger 11.4.6-depup.1 - @devicerail/yaml-adapter 0.1.0 and more Source cves:...

@aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.6), @aaravpos/appointment-booking-plugin (>=1.0.1, <=8.0.2) +271 more potentially affected by unknown CVE via react-router (>=7.12.0, <=7.18.1)

react-router NPM version =7.12.0, =1.0.0, =1.0.1, =0.0.9-alpha-20260107202750-16b04dcbaa92c7fc2bbb580dbc1da723c76a5225, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source...

GHSA-V75C-CRR9-733C

creationtimestamp| type| source ---|---|--- 2026-07-15 04:34:38+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqnvfpbgnk2w...

GHSA-7M6Q-GGF5-RWG4 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-X6RC-7QVR-596R vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-823W-23RP-2JJX vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-J52W-H358-GGWW vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-4GXM-V5V7-FQC4 pnpm: Reserved bin name deletes PNPM_HOME during global remove

Maintainer Action Plan Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected fixed behavior, then use the detailed exploit narrative below only if you want to replay the original path. - Advisory: CAND-PNPM-085 / GHSA-4gxm-v5v7-fqc4...

CVE-2026-33684

creationtimestamp| type| source ---|---|--- 2026-06-22 14:00:15+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-8j8m-p79x-g4jm...

@kozou/api (>=1.0.0, <=1.8.0), @kozou/codegen (>=1.0.0, <=1.8.0) +5 more potentially affected by unknown CVE via @kozou/core (>=1.0.0, <=1.8.0)

@kozou/core NPM version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0, =1.0.0, =1.8.0 Source cves: unknown CVE Source advisory: OSV:GHSA-V52W-28XH-V562...

@adyen/adyen-salesforce-pwa (>=2.0.0, <=3.0.4), @angular-builders/custom-esbuild (>=18.0.0-beta.3, <=19.1.0) +136 more potentially affected by CVE-2026-55603 via http-proxy-middleware (>=3.0.5, <=3.0.6)

http-proxy-middleware NPM version =3.0.5, =2.0.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.2.19, =1.0.2, =0.9.1-next.19, =0.9.1-next.19, =0.9.1-next.19, =0.0.4, =3.0.0-alpha-1, =21.2.2-depup.0, =24.3.0-depup.0, =24.11.1-depup.1 and more Source cves: CVE-2026-55603 Source advisor...

GHSA-4H4G-832R-8C7F vulnerabilities

Vulnerabilities for packages: chromium...

@adobe/spacecat-shared-brand-client (>=1.1.31, <=1.1.35), @adobe/spacecat-shared-cloud-manager-client (>=1.0.0, <=1.4.3) +255 more potentially affected by CVE-2026-48038 via joi (>=18.0.0, <=18.1.2)

joi NPM version =18.0.0, =1.1.31, =1.0.0, =1.8.6, =2.61.4, =1.4.60, =1.6.11, =1.19.1, =1.11.2, =2.2.1, =1.0.0, =1.12.0, =3.14.0, =25.109.0-beta.1, =26.1.0 and more Source cves: CVE-2026-48038 Source advisory: OSV:GHSA-Q7CG-457F-VX79...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +644 more potentially affected by CVE-2026-47674 via hono (>=4.0.0, <=4.12.19)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-47674 Source advisory: OSV:GHSA-XRHX-7G5J-RCJ5...

GHSA-3V7F-55P6-F55P

creationtimestamp| type| source ---|---|--- 2026-05-30 02:23:48+00:00| seen| https://gist.github.com/konard/ddaf1c7a82581f9e29a8359316e48df3 2026-05-30 12:07:18+00:00| seen| https://gist.github.com/konard/f3567870039c68dff77f077e839add9b...

@budibase/server (>=3.32.1, <=3.38.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.6.6, <=2.1.0) +64 more potentially affected by CVE-2026-42573 via svelte (>=5.0.0, <=5.55.5)

svelte NPM version =5.0.0, =3.32.1, =0.6.6, =4.0.0-alpha.1, =4.0.0-alpha.1, =0.1.0, =0.0.1, =1.3.0, =0.1.4, =0.0.20, =0.15.0-beta.2, =1.1.0-beta.0, =5.0.0-next.80, =5.0.0-test.1 and more Source cves: CVE-2026-42573 Source advisory: OSV:GHSA-RCQX-6Q8C-2C42...

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +761 more potentially affected by CVE-2026-44579 via next (>=16.0.0, <=16.2.4)

next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-44579 Source advisory:...