CLEANSTART-2026-OI46313 Security fixes in az 2.83.0-r3

Package az version 2.83.0-r3 fixes 1 vulnerabilities: ghsa-537c-gmf6-5ccf...

CLEANSTART-2026-AA71310 Security fixes in spire-server-fips 1.14.5-r0

Package spire-server-fips version 1.14.5-r0 fixes 3 vulnerabilities: CVE-2026-33816, ghsa-xmrv-pmrh-hhx2, CVE-2026-34986...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2026-44907 via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.0.4, =2.0.3-next.0 an...

@adobe/aem-cli (>=16.21.1, <=16.21.6), @adobe/helix-docx2md (>=1.9.29, <=1.9.31) +97 more potentially affected by CVE-2026-73643 via js-yaml (>=5.0.0, <=5.2.1)

js-yaml NPM version =5.0.0, =16.21.1, =1.9.29, =6.29.8, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =0.0.1-alpha.0, =1.0.8, =0.1.2, =0.11.0, =5.7.5, =7.0.2 - @davidsneighbour/markdownlint-config 2026.0.5 - @depup/nestjsswagger 11.4.6-depup.1 - @devicerail/yaml-adapter 0.1.0 and more Source cves:...

@aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.6), @aaravpos/appointment-booking-plugin (>=1.0.1, <=8.0.2) +274 more potentially affected by unknown CVE via react-router (>=7.12.0, <=7.18.1)

react-router NPM version =7.12.0, =1.0.0, =1.0.1, =0.0.9-alpha-20260107202750-16b04dcbaa92c7fc2bbb580dbc1da723c76a5225, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source...

GHSA-V75C-CRR9-733C

creationtimestamp| type| source ---|---|--- 2026-07-15 04:34:38+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqnvfpbgnk2w...

GHSA-7M6Q-GGF5-RWG4 vulnerabilities

Vulnerabilities for packages: chromium...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management in the ActiveDirectoryIdentityProvider process. An attacker can gain elevated permissions in Kubernetes clusters by editing the distinguished name DN of group entries in the Active Directory server's databa...

GHSA-X6RC-7QVR-596R vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-823W-23RP-2JJX vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-J52W-H358-GGWW vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-4GXM-V5V7-FQC4 pnpm: Reserved bin name deletes PNPM_HOME during global remove

Maintainer Action Plan Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected fixed behavior, then use the detailed exploit narrative below only if you want to replay the original path. - Advisory: CAND-PNPM-085 / GHSA-4gxm-v5v7-fqc4...

Arbitrary Argument Injection

Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to Arbitrary Argument Injection in the git fetcher at fetching/git-fetcher/src/index.ts, which passes the lockfile's resolution.commit value into git fetch and git checkout without a --...

CVE-2026-33684

creationtimestamp| type| source ---|---|--- 2026-06-22 14:00:15+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-8j8m-p79x-g4jm...

@kozou/api (>=1.0.0, <=1.8.0), @kozou/codegen (>=1.0.0, <=1.8.0) +5 more potentially affected by unknown CVE via @kozou/core (>=1.0.0, <=1.8.0)

@kozou/core NPM version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0, =1.0.0, =1.8.0 Source cves: unknown CVE Source advisory: OSV:GHSA-V52W-28XH-V562...

@adyen/adyen-salesforce-pwa (>=2.0.0, <=3.0.4), @angular-builders/custom-esbuild (>=18.0.0-beta.3, <=19.1.0) +136 more potentially affected by CVE-2026-55603 via http-proxy-middleware (>=3.0.5, <=3.0.6)

http-proxy-middleware NPM version =3.0.5, =2.0.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.2.19, =1.0.2, =0.9.1-next.19, =0.9.1-next.19, =0.9.1-next.19, =0.0.4, =3.0.0-alpha-1, =21.2.2-depup.0, =24.3.0-depup.0, =24.11.1-depup.1 and more Source cves: CVE-2026-55603 Source advisor...

GHSA-4H4G-832R-8C7F vulnerabilities

Vulnerabilities for packages: chromium...

@adobe/spacecat-shared-brand-client (>=1.1.31, <=1.1.35), @adobe/spacecat-shared-cloud-manager-client (>=1.0.0, <=1.4.3) +255 more potentially affected by CVE-2026-48038 via joi (>=18.0.0, <=18.1.2)

joi NPM version =18.0.0, =1.1.31, =1.0.0, =1.8.6, =2.61.4, =1.4.60, =1.6.11, =1.19.1, =1.11.2, =2.2.1, =1.0.0, =1.12.0, =3.14.0, =25.109.0-beta.1, =26.1.0 and more Source cves: CVE-2026-48038 Source advisory: OSV:GHSA-Q7CG-457F-VX79...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +645 more potentially affected by CVE-2026-47674 via hono (>=4.0.0, <=4.12.19)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-47674 Source advisory: OSV:GHSA-XRHX-7G5J-RCJ5...

GHSA-3V7F-55P6-F55P

creationtimestamp| type| source ---|---|--- 2026-05-30 02:23:48+00:00| seen| https://gist.github.com/konard/ddaf1c7a82581f9e29a8359316e48df3 2026-05-30 12:07:18+00:00| seen| https://gist.github.com/konard/f3567870039c68dff77f077e839add9b...