GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: zarf-fips, skaffold-fips, trivy, bom, buildkitd-fips, flux-source-controller-fips, flux-source-controller, tkn, commercial-kyverno, cosign-fips, ko-fips, chainloop-control-plane-fips, skaffold, vexctl, trivy-operator-fips, cosign, gitlab-runner-fips, falcoctl-fips,...

aperture-cli (>=0.0.0.dev1, <=1.0.0), aperturelib (>=0.0.0.dev1, <=1.0.0) +27 more potentially affected by CVE-2026-42308 via pillow (5.0.0)

pillow PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aperture-cli =0.0.0.dev1, =0.0.0.dev1, =0.0.1.dev1, =0.0.2, =0.2.0, =0.1.2, =0.1.9, =0.1.0, =1.0.0, =0.7.0, =0.9.8, =1.0.1, =1.0.2.post2 and more...

banner-ad-toolkit (>=0.3.1, <=0.3.2), bcipy (>=1.1.1, <=1.2.0) +64 more potentially affected by CVE-2026-42308 via pillow (4.3.0)

pillow PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - banner-ad-toolkit =0.3.1, =1.1.1, =2.2.0, =1.4.9, =2.0.0, =0.1.0a0, =1.1.0, =0.23.0, =0.2.6, =0.6.0, =2.3.0.18073018, =2.3.6.19012721 and more Sourc...

GHSA-5M4P-2GJX-P2G8 vulnerabilities

Vulnerabilities for packages: pgtimetable, kbld, conftest, flyte, containerd, shfmt, kuma, aws-flb-kinesis, kube-logging-operator, kpt, mattermost, rancher-system-upgrade-controller, speedtest-go, undock, k3d, datadog-agent, nats, newrelic-nri-statsd, migrate, opentelemetry-collector, paranoia,...

mvrk (>=1.2.0, <=1.2.1), repo-cli (>=0.0.1.8, <=0.0.1.14) potentially affected by CVE-2026-44897 via mistune (2.0.0a4)

mistune PYPI version 2.0.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - mvrk =1.2.0, =0.0.1.8, =0.0.1.14 Source cves: CVE-2026-44897 Source advisory: OSV:GHSA-V87V-83H2-53W7...

mvrk (>=1.2.0, <=1.2.1), repo-cli (>=0.0.1.8, <=0.0.1.14) potentially affected by CVE-2026-44708 via mistune (2.0.0a4)

mistune PYPI version 2.0.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - mvrk =1.2.0, =0.0.1.8, =0.0.1.14 Source cves: CVE-2026-44708 Source advisory: OSV:GHSA-8G87-J6Q8-G93X...

arca (>=0.1.1, <=0.3.1), epab (>=2018.4.2.1, <=2018.4.2.3) +3 more potentially affected by CVE-2026-67326 via gitpython (2.1.9)

gitpython PYPI version 2.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - arca =0.1.1, =2018.4.2.1, =1.0.3, =0.0.0, =0.4.1 - ubuntudesign-documentation-builder 1.6.0 Source cves: CVE-2026-67326 Source advisory:...

bento-cli (>=0.1.0, <=0.1.1), walletlib (0.1.0) potentially affected by CVE-2026-67326 via gitpython (2.1.14)

gitpython PYPI version 2.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bento-cli =0.1.0, =0.1.1 - walletlib 0.1.0 Source cves: CVE-2026-67326 Source advisory: OSV:GHSA-MV93-W799-CJ2W...

bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2026-67326 via gitpython (2.1.3)

gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2026-67326 Source advisory: OSV:GHSA-MV93-W799-CJ2W...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @middy/validator (>=5.4.3, <=5.4.4) +4 more potentially affected by CVE-2026-6322 via fast-uri (>=3.0.1, <=3.1.0)

fast-uri NPM version =3.0.1, =0.3.1, =5.4.3, =1.0.0, =1.0.0, =2.2.0, =2.3.1 Source cves: CVE-2026-6322 Source advisory: OSV:GHSA-V39H-62P7-JPJC...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @middy/validator (>=5.4.3, <=5.4.4) +4 more potentially affected by CVE-2026-6321 via fast-uri (>=3.0.1, <=3.1.0)

fast-uri NPM version =3.0.1, =0.3.1, =5.4.3, =1.0.0, =1.0.0, =2.2.0, =2.3.1 Source cves: CVE-2026-6321 Source advisory: GHSA-Q3J6-QGPJ-74H6...

@activepieces/piece-amazon-textract (>=0.2.0, <=0.3.0), @activepieces/piece-salesforce (0.7.2) +3 more potentially affected by CVE-2026-44665 via fast-xml-builder (1.1.4)

fast-xml-builder NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on fast-xml-builder and may be impacted: - @activepieces/piece-amazon-textract =0.2.0, =0.2.1, =0.0.4, =10.4.0, =10.5.0 Source cves: CVE-2026-44665 Source advisory:...

@activepieces/piece-amazon-textract (>=0.2.0, <=0.3.0), @activepieces/piece-salesforce (0.7.2) +3 more potentially affected by CVE-2026-44665 via fast-xml-builder (1.1.4)

fast-xml-builder NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on fast-xml-builder and may be impacted: - @activepieces/piece-amazon-textract =0.2.0, =0.2.1, =0.0.4, =10.4.0, =10.5.0 Source cves: CVE-2026-44665 Source advisory:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +283 more potentially affected by CVE-2026-44008 via vm2 (>=3.0.0, <=3.11.1)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

GHSA-WWPQ-F5C3-7HVX vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, zipkin, thingsboard, apache-nifi-registry...

CVE-2026-40973 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, zipkin, thingsboard, apache-nifi-registry...

CVE-2026-40973 vulnerabilities

Vulnerabilities for packages: nacos-docker, kafbat-ui, keycloak-config-cli, conductor-fips, apache-nifi-registry, conductor, nacos, thingsboard, kafbat-ui-fips, zipkin, camunda-zeebe...

GHSA-WWPQ-F5C3-7HVX vulnerabilities

Vulnerabilities for packages: nacos-docker, kafbat-ui, keycloak-config-cli, conductor-fips, apache-nifi-registry, conductor, nacos, thingsboard, kafbat-ui-fips, zipkin, camunda-zeebe...

CVE-2026-42150 wlc: print_html outputs API data without HTML escaping, enabling stored XSS

wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0...

CVE-2026-43944: Improper Input Validation

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or...