org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.20), org.jboss.arquillian.container:arquillian-tomcat-embedded-7 (>=1.0.0.cr4, <=1.0.0.cr6) +2 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (7.0.20)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.20 -...

com.abavilla:fpi-bot-api (>=1.0.2, <=1.1.0), com.abavilla:fpi-bot-api-core (>=1.0.2, <=1.1.0) +136 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.12.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.12.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.abavilla:fpi-bot-api =1.0.2, =1.0.2, =1.0.2, =1.0.132, =v1.3.1, =v1.3.1, =1.0.42, =1.0.42,...

bugbug (0.0.593), chatlas-chains (>=0.1.3, <=0.3.3) +4 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.32)

langchain-openai PYPI version 0.3.32 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - bugbug 0.0.593 - chatlas-chains =0.1.3, =1.0.0, =0.1.8, =0.0.86, =0.0.92 Source cves: CVE-2026-41488 Source advisory:...

bugbug (0.0.593), chatlas-chains (>=0.1.3, <=0.3.3) +4 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.32)

langchain-openai PYPI version 0.3.32 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - bugbug 0.0.593 - chatlas-chains =0.1.3, =1.0.0, =0.1.8, =0.0.86, =0.0.92 Source cves: CVE-2026-41488 Source advisory:...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m3, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m3, <=10.0.0) +2 more potentially affected by CVE-2026-34500 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30, <=10.1.52)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.1.4 Source cves: CVE-2026-34500 Source advisory: OSV:GHSA-24J9-X2WG-9QV6...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m3, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m3, <=10.0.0) +2 more potentially affected by CVE-2026-29145 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30, <=10.1.52)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.1.4 Source cves: CVE-2026-29145 Source advisory: OSV:GHSA-95JQ-RWVF-VJX4...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m3, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m3, <=10.0.0) +2 more potentially affected by CVE-2026-34500 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30, <=10.1.52)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.1.4 Source cves: CVE-2026-34500 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-15989819...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: gitea, nuclei, argo-cd, argo-cd-fips, argo-workflows-fips, kaniko, gomplate-fips, cloudbeat, kubescape, chainctl-fips, steampipe, gptscript, gitsign, external-secrets-operator, kyverno-fips, zarf-fips, kubescape-server, grafana-alloy, dagger,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: gitea, nuclei, argo-cd, argo-cd-fips, argo-workflows-fips, kaniko, gomplate-fips, cloudbeat, kubescape, chainctl-fips, steampipe, gptscript, gitsign, external-secrets-operator, kyverno-fips, zarf-fips, kubescape-server, grafana-alloy, dagger,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: gitea, nuclei, argo-cd, argo-cd-fips, argo-workflows-fips, kaniko, gomplate-fips, cloudbeat, kubescape, chainctl-fips, steampipe, gptscript, gitsign, external-secrets-operator, kyverno-fips, zarf-fips, kubescape-server, grafana-alloy, dagger,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: tfsec, grype, kyverno, trivy-operator, kubescape, pulumi-kubernetes-operator, cerbos, src-fingerprint, pulumi-language-dotnet, flux-image-automation-controller, nuclei, snyk-cli, zarf, guac, kaniko, rancher-fleet, nfpm, chezmoi, wolfictl, syft, dagger, argo-events,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: tfsec, grype, kyverno, trivy-operator, kubescape, pulumi-kubernetes-operator, cerbos, src-fingerprint, pulumi-language-dotnet, flux-image-automation-controller, nuclei, snyk-cli, zarf, guac, kaniko, rancher-fleet, nfpm, chezmoi, wolfictl, syft, dagger, argo-events,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: tfsec, grype, kyverno, trivy-operator, kubescape, pulumi-kubernetes-operator, cerbos, src-fingerprint, pulumi-language-dotnet, flux-image-automation-controller, nuclei, snyk-cli, zarf, guac, kaniko, rancher-fleet, nfpm, chezmoi, wolfictl, syft, dagger, argo-events,...

terminal-buddy (>=0.1.1, <=0.1.2), ws-bom-robot-app (>=0.0.86, <=0.0.88) potentially affected by CVE-2026-34070 via langchain-core (0.3.75)

langchain-core PYPI version 0.3.75 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - terminal-buddy =0.1.1, =0.0.86, =0.0.88 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

terminal-buddy (>=0.1.1, <=0.1.2), ws-bom-robot-app (>=0.0.86, <=0.0.88) potentially affected by CVE-2026-34070 via langchain-core (0.3.75)

langchain-core PYPI version 0.3.75 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - terminal-buddy =0.1.1, =0.0.86, =0.0.88 Source cves: CVE-2026-34070 Source advisory: OSV:GHSA-QH6H-P6C9-FF54...

terminal-buddy (>=0.1.1, <=0.1.2), ws-bom-robot-app (>=0.0.86, <=0.0.88) potentially affected by CVE-2026-26013 via langchain-core (0.3.75)

langchain-core PYPI version 0.3.75 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - terminal-buddy =0.1.1, =0.0.86, =0.0.88 Source cves: CVE-2026-26013 Source advisory: OSV:GHSA-2G6R-C272-W58R...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, kwok, pluto, terraform-provider-azapi, envconsul, ko, nri-mysql, crossplane-provider-azure-storage, azure-service-operator, x509-certificate-exporter, wuzz, crossplane-provider-keycloak, consul-k8s, tetragon, snyk-cli, metallb,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, kwok, pluto, terraform-provider-azapi, envconsul, ko, nri-mysql, crossplane-provider-azure-storage, azure-service-operator, x509-certificate-exporter, wuzz, crossplane-provider-keycloak, consul-k8s, tetragon, snyk-cli, contour,...

CVE-2025-27379

A stored cross-site scripting XSS vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content...