10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1539 more potentially affected by CVE-2024-21643 +1 more via pyjwt (>=2.0.0, <=2.12.1)

pyjwt PYPI version =2.0.0, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2024-21643, CVE-2026-48522 Source advisory: GHSA-993G-76C3-P5M4...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1539 more potentially affected by CVE-2026-48522 via pyjwt (>=2.0.0, <=2.12.1)

pyjwt PYPI version =2.0.0, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-48522 Source advisory: OSV:GHSA-993G-76C3-P5M4...

atlassian-jwt-auth (>=2.0.0, <=2.6.0), clink (>=0.10.0, <=0.23.0) +7 more potentially affected by CVE-2026-48526 via pyjwt (1.4.0)

pyjwt PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - atlassian-jwt-auth =2.0.0, =0.10.0, =0.0.1.dev1, =0.0.1.dev3, =0.4.0, =3.1.0, =1.1.0, =0.8.0, =0.9.0 Source cves: CVE-2026-48526 Source advisory:...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1596 more potentially affected by CVE-2026-48526 via pyjwt (>=2.0.0a2, <=2.12.1)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-48526 Source advisory: GHSA-XGMM-8J9V-C9WX...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1539 more potentially affected by CVE-2026-48524 via pyjwt (>=2.0.0, <=2.12.1)

pyjwt PYPI version =2.0.0, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-48524 Source advisory: OSV:GHSA-FHV5-28VV-H8M8...

10minions-engine (>=0.0.1, <=0.0.4), @1amageek/document-propagator (>=0.10.1, <=1.0.0) +1527 more potentially affected by CVE-2026-54269 via protobufjs-cli (>=1.0.0, <=1.2.2)

protobufjs-cli NPM version =1.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0-alpha.2, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2026-54269 Source advisory: OSV:GHSA-F38Q-MGVJ-VPH7...

10minions-engine (>=0.0.1, <=0.0.4), @1amageek/document-propagator (>=0.10.1, <=1.0.0) +1527 more potentially affected by CVE-2026-54269 via protobufjs-cli (>=1.0.0, <=1.2.2)

protobufjs-cli NPM version =1.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0-alpha.2, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2026-54269 Source advisory: SNYK:JS-PROTOBUFJSCLI-17353169...

10minions-engine (>=0.0.1, <=0.0.4), @1amageek/document-propagator (>=0.10.1, <=1.0.0) +1527 more potentially affected by CVE-2026-54269 via protobufjs-cli (>=1.0.0, <=1.2.2)

protobufjs-cli NPM version =1.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0-alpha.2, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2026-54269 Source advisory: GHSA-F38Q-MGVJ-VPH7...

Improper Check for Unusual or Exceptional Conditions

Overview protobufjs-cli is a Translates between file formats and generates static code as well as TypeScript definitions. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the schema-derived names that collide with runtime-significant...

NPM: protobufjs : Schema-derived names can shadow runtime-significant properties

NPM: protobufjs : Schema-derived names can shadow runtime-significant properties vulnerability discovered by ? in WordPress Npm protobufjs-cli versions = 1.3.2...

7ghost-cli (>=1.17.6-next.0, <=1.18.4), @5ht/express (>=1.0.6, <=2.2.0) +649 more potentially affected by CVE-2026-12143 via form-data (>=3.0.0, <=3.0.4)

form-data NPM version =3.0.0, =1.17.6-next.0, =1.0.6, =1.0.0, =0.12.4, =1.1.3, =1.9.19, =1.1.0, =1.18.0, =2.13.1, =1.1.0, =10.1.0, =1.0.0, =1.9.2, =2.1.4 and more Source cves: CVE-2026-12143 Source advisory: OSV:GHSA-HMW2-7CC7-3QXX...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) +1 more potentially affected by CVE-2026-53632 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =3.15.0-alpha.1776572752298, =3.19.3 Source cves: CVE-2026-53632 Source advisory: GHSA-V6WH-96G9-6WX3...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) +1 more potentially affected by CVE-2026-53571 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =3.15.0-alpha.1776572752298, =3.19.3 Source cves: CVE-2026-53571 Source advisory: SNYK:JS-VITEPLUS-17353903...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) +1 more potentially affected by CVE-2026-53571 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =3.15.0-alpha.1776572752298, =3.19.3 Source cves: CVE-2026-53571 Source advisory: GHSA-FX2H-PF6J-XCFF...

CVE-2026-48723: Improper Neutralization of Special Elements used in an OS Command

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypressconfigfile configuration parameter. In readCypressConfigUtil.js, the loadJsFile function constructs a shell...

Maestro 0.17.0

Maestro is a cross-platform desktop app for orchestrating your fleet of AI agents and projects. It's a high-velocity solution for hackers who are juggling multiple projects in parallel. Designed for power users who live on the keyboard and rarely touch the mouse. Collaborate with AI to create...

CVE-2026-42853

ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command...

CVE-2026-42853 @apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input

ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command...

CVE-2026-42853 @apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input

ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command...

@actual-app/api (>=26.4.0-nightly.20260317, <=26.5.0-nightly.20260503), @actual-app/cli (>=26.4.0-nightly.20260319, <=26.5.0-nightly.20260503) +1 more potentially affected by CVE-2026-43872 via @actual-app/core (>=26.4.0-nightly.20260317, <=26.5.0-nightly.20260503)

@actual-app/core NPM version =26.4.0-nightly.20260317, =26.4.0-nightly.20260317, =26.4.0-nightly.20260319, =0.1.5, =0.1.7 Source cves: CVE-2026-43872 Source advisory: SNYK:JS-ACTUALAPPCORE-17879970...