@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.3), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.3) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-beta.3)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.3 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.4), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.0.0-beta.1, <=1.4.4)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.4 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5-beta.0), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5-beta.0) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0-beta.0, <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5-beta.0 Source cves: CVE-2026-40163 Source advisory: GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.3), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.3) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-beta.3)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.3 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.2), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.2) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0-beta.0, <=1.5.2)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.2 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.4), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.0.0-beta.1, <=1.4.4)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.4 Source cves: CVE-2026-40163 Source advisory: GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5-beta.0), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5-beta.0) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0-beta.0, <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5-beta.0 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5-beta.0), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5-beta.0) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0-beta.0, <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5-beta.0 Source cves: CVE-2026-40163 Source advisory: MEND:CVE-2026-40163...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.3), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.3) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-beta.3)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.3 Source cves: CVE-2026-40163 Source advisory: MEND:CVE-2026-40163...

CVE-2026-39977

flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using gfileresolverelativepath and...

DEBIAN-CVE-2026-39977

flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using gfileresolverelativepath and...

UBUNTU-CVE-2026-39977

flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using gfileresolverelativepath and...

CVE-2026-39977

flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using gfileresolverelativepath and...

amaranth-yosys (0.25.0.0.post69), polywrap-client (0.1.0a17) +4 more potentially affected by CVE-2026-34983 via wasmtime (6.0.0)

wasmtime PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.25.0.0.post69 - polywrap-client 0.1.0a17 - polywrap-client-config-builder 0.1.0a17 - polywrap-uri-resolvers =0.1.0a15, =0.1.0a1...

CVE-2026-39977

flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using gfileresolverelativepath and...

CVE-2026-39977

The CVE concerns flatpak-builder (versions 1.4.5–1.4.7) where the license-files manifest key accepts an array of paths relative to the module source. Paths are validated using two checks, but the final path component and symlink handling can allow path traversal. The copy operation runs on the ho...

CVE-2026-39977

flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using gfileresolverelativepath and...

CVE-2026-39977

flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using gfileresolverelativepath and...

CVE-2026-39977 flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files

flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using gfileresolverelativepath and...

EUVD-2026-21045

flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using gfileresolverelativepath and...