PT-2026-62053

Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph walk cell and sph alloc slot. The attach-time validator sph validate header checks the header scalars and region layout against the file size, but...

PT-2026-63053

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description A security flaw in the Oracle Agile PLM product of Oracle Supply Chain allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can result in a...

Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

PT-2026-62511

Name of the Vulnerable Software and Affected Versions Oracle Transportation Management version 6.5.3 Description An issue exists in the Authentication component of the Oracle Transportation Management product within Oracle Supply Chain. A low privileged attacker with network access via HTTP can...

CVE-2026-60812: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-Business Suite component: Collaboration History. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

PT-2026-62798

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Supply Chain Trading Connector versions 12.2.3 through 12.2.15 Description An issue exists in the Collaboration History component of the Oracle Supply Chain Trading Connector. A low privileged attacker with netwo...

PT-2026-63129

Vulnerability in the Oracle Supply Chain Globalization product of Oracle E-Business Suite component: Copy Inventory Organization. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2026-60811: Improper Access Control

Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-Business Suite component: Collaboration History. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

MAL-2026-11042 Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

CVE-2026-60810: Missing Authentication for Critical Function

Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-Business Suite component: Collaboration History. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

PT-2026-62796

Name of the Vulnerable Software and Affected Versions Oracle Supply Chain Trading Connector versions 12.2.3 through 12.2.15 Description An issue exists in the Collaboration History component of the Oracle Supply Chain Trading Connector. An unauthenticated attacker with network access via HTTP can...

@a1st/aix (>=0.0.3, <=0.8.0), @a1st/aix-core (>=0.2.0, <=0.8.0) +10 more potentially affected by CVE-2026-73424 via @astrojs/vercel (>=10.0.6, <=10.0.8)

@astrojs/vercel NPM version =10.0.6, =0.0.3, =0.2.0, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.3.0 - taskair 0.0.1 Source cves: CVE-2026-73424 Source advisory: SNYK:JS-ASTROJSVERCEL-18599401...

astro-simpleanalytics-plugin (0.4.0), lanza-site (>=0.1.0, <=0.1.10) potentially affected by CVE-2026-59729 via astro (>=7.0.2, <=7.0.3)

astro NPM version =7.0.2, =0.1.0, =0.1.10 Source cves: CVE-2026-59729 Source advisory: OSV:GHSA-F48W-9M4C-M7F5...

@chocolatey-software/astro (>=2.0.0, <=2.8.0), @kunyan/astro-blog (>=0.1.3, <=0.1.4) +19 more potentially affected by CVE-2026-59728 via @astrojs/rss (>=2.4.0, <=4.0.18)

@astrojs/rss NPM version =2.4.0, =2.0.0, =0.1.3, =0.0.1, =0.1.0, =0.0.9, =0.1.0, =0.2.0, =0.0.1, =1.0.29, =0.1.0, =0.2.0 and more Source cves: CVE-2026-59728 Source advisory: SNYK:JS-ASTROJSRSS-18085631...

minder v0.2.1

| | | | | Installation | Documentation | Releases What is Minder? Minder is an open source platform that helps development teams and open source communities build more secure software, and prove to others that what they’ve built is secure. Minder helps project owners proactively manage their...

123pancli (1.0.0), @142vip/axios (>=0.0.1-alpha.9, <=0.0.1-alpha.11) +2575 more potentially affected by CVE-2026-67320 via axios (>=1.15.2, <=1.17.0)

axios NPM version =1.15.2, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.1.3-rc.0, =0.1.0, =0.1.4 - @abhinav-dev/mcp-platform-kit 1.0.0 - @accelbyte/sdk 4.3.2 - @accelbyte/sdk-achievement 5.3.5 - @accelbyte/sdk-ams 5.3.5 - @accelbyte/sdk-audit 6.0.5 -...

@a-rt-works/auth0-deploy-cli (3.3.3), @acknow-srl/express-openid (>=1.0.0, <=1.0.1) +537 more potentially affected by CVE-2026-67320 via axios (>=0.31.1, <=0.32.0)

axios NPM version =0.31.1, =1.0.0, =0.0.1, =0.0.2, =1.3.2, =0.2.0, =0.0.2-beta.0, =2.0.14, =0.5.12, =1.0.0, =1.0.1, =32.0.0, =0.2.4, =0.3.0 and more Source cves: CVE-2026-67320 Source advisory: OSV:GHSA-GCFJ-64VW-6MP9...

123pancli (1.0.0), @142vip/axios (>=0.0.1-alpha.9, <=0.0.1-alpha.11) +2643 more potentially affected by CVE-2026-67321 via axios (>=1.15.1, <=1.17.0)

axios NPM version =1.15.1, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.1.3-rc.0, =0.1.0, =0.1.4 - @abhinav-dev/mcp-platform-kit 1.0.0 - @accelbyte/sdk 4.3.2 - @accelbyte/sdk-achievement 5.3.5 - @accelbyte/sdk-ams 5.3.5 - @accelbyte/sdk-audit 6.0.5 -...

@a-rt-works/auth0-deploy-cli (3.3.3), @acknow-srl/express-openid (>=1.0.0, <=1.0.1) +537 more potentially affected by CVE-2026-67321 via axios (>=0.31.1, <=0.32.0)

axios NPM version =0.31.1, =1.0.0, =0.0.1, =0.0.2, =1.3.2, =0.2.0, =0.0.2-beta.0, =2.0.14, =0.5.12, =1.0.0, =1.0.1, =32.0.0, =0.2.4, =0.3.0 and more Source cves: CVE-2026-67321 Source advisory: OSV:GHSA-HCPX-6FM6-WX23...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +17231 more potentially affected by CVE-2026-67319 via axios (>=1.0.0, <=1.17.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-67319 Source advisory: SNYK:JS-AXIOS-18065349...