ROOT-APP-NPM-CVE-2026-33671 CVE-2026-33671 in @rootio/picomatch - Patched by Root

Root has patched CVE-2026-33671 in the @rootio/picomatch package for Root:npm. Multiple fixed versions available...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub

Summary The following dependency packages are being used by IBM Db2 Genius Hub. flatted-3.3.3.tgz , axios-1.15.1.tgz, immutable-4.0.0-rc.12.tgz , lodash-4.17.23.tgz, jspdf-3.0.2.tgz , swiper-11.2.10.tgz , picomatch-2.3.1.tgz , axios-1.12.2.tgz , router-1.23.0.tgz , minimatch-10.2.1.tgz ,...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in Picomatch (CVE-2026-33671, CVE-2026-33672)

Summary SPSS Collaboration and Deployment Services is affected by vulnerabilities in Picomatch CVE-2026-33671, CVE-2026-33672. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch is a glob matcher written JavaScript. Versions prior...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in picomatch-2.3.1.tgz

Summary IBM Watson Discovery Cartridge affected by vulnerabilities in picomatch-2.3.1.tgz Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service ReDoS...

Security Bulletin: IBM Edge Data Collector uses picomatch-2.3.1.tgz which is vulnerable to CVE-2026-33671, CVE-2026-33672.

Summary IBM Edge Data Collector uses picomatch-2.3.1.tgz which is vulnerable to CVE-2026-33671, CVE-2026-33672. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch is a glob matcher written JavaScript. Versions prior t...

CVE-2026-33671 affecting package nodejs24 for versions less than 24.14.1-2

CVE-2026-33671 affecting package nodejs24 for versions less than 24.14.1-2. A patched version of the package is available...

CVE-2026-33671 vulnerabilities

Vulnerabilities for packages: pulumi, rancher-api-ui, nextcloud-server, lerna, ts-patch, kubeflow-pipelines, code-server, prism, vitess, vite, renovate, argo-workflows, tileserver-gl, npm, opensearch-dashboards, kubeflow-katib, node-gyp, sqlpad, saf...

CVE-2026-33671 vulnerabilities

Vulnerabilities for packages: graalvm, gitlab-rails-ce-fips, opensearch-dashboards, vite, langfuse-fips, emscripten, saf, wazuh-dashboard, kibana, sqlpad, lerna, tileserver-gl-fips, renovate, node-gyp, code-server, kubeflow-katib, kubeflow-pipelines, argo-workflows, prism, semaphore,...

@10xsai/cloudflare-router-nx-plugin (1.0.0), @4itech/schematics (>=11.7.1, <=11.7.6) +1098 more potentially affected by CVE-2026-33671 via picomatch (>=4.0.0, <=4.0.3)

picomatch NPM version =4.0.0, =11.7.1, =1.2.0, =8.3.0-rc.2, =1.0.25, =0.0.17, =0.0.47, =0.0.1, =1.0.0, =1.0.0, =10.0.0-alpha.1, =10.0.0-prerelease.90, =13.0.0-next.10, =10.0.0-prerelease.90, =14.0.0-next.1 and more Source cves: CVE-2026-33671 Source advisory: SNYK:JS-PICOMATCH-15765511...

@10xsai/cloudflare-router-nx-plugin (1.0.0), @4itech/schematics (>=11.7.1, <=11.7.6) +1098 more potentially affected by CVE-2026-33671 via picomatch (>=4.0.0, <=4.0.3)

picomatch NPM version =4.0.0, =11.7.1, =1.2.0, =8.3.0-rc.2, =1.0.25, =0.0.17, =0.0.47, =0.0.1, =1.0.0, =1.0.0, =10.0.0-alpha.1, =10.0.0-prerelease.90, =13.0.0-next.10, =10.0.0-prerelease.90, =14.0.0-next.1 and more Source cves: CVE-2026-33671 Source advisory: OSV:GHSA-C2C7-RCM5-VVQJ...

4itech-schematics (>=11.3.0-2, <=11.7.0-5), @4itech/schematics (11.7.0) +71 more potentially affected by CVE-2026-33671 via picomatch (3.0.1)

picomatch NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on picomatch and may be impacted: - 4itech-schematics =11.3.0-2, =10.0.0-alpha.1, =10.0.0-alpha.1, =10.0.0-alpha.1, =0.1700.0-rc.3, =0.1700.0-rc.3, =17.0.0-rc.3, =0.1700.0-rc.3,...

4itech-schematics (>=11.0.0-0, <=11.3.0-1), @142vip/midway (>=0.1.6-alpha.2, <=0.1.6-alpha.12) +573 more potentially affected by CVE-2026-33671 via picomatch (>=2.1.1, <=2.3.1)

picomatch NPM version =2.1.1, =11.0.0-0, =0.1.6-alpha.2, =7.4.1, =0.0.1, =1.0.1, =0.0.2, =2.0.0, =9.0.0-alpha.28, =9.2.0-alpha.9, =9.2.0-alpha.9, =1.0.101, =1.1.0, =1.4.1 and more Source cves: CVE-2026-33671 Source advisory: OSV:GHSA-C2C7-RCM5-VVQJ...

4itech-schematics (>=11.0.0-0, <=11.3.0-1), @142vip/midway (>=0.1.6-alpha.2, <=0.1.6-alpha.12) +573 more potentially affected by CVE-2026-33671 via picomatch (>=2.1.1, <=2.3.1)

picomatch NPM version =2.1.1, =11.0.0-0, =0.1.6-alpha.2, =7.4.1, =0.0.1, =1.0.1, =0.0.2, =2.0.0, =9.0.0-alpha.28, =9.2.0-alpha.9, =9.2.0-alpha.9, =1.0.101, =1.1.0, =1.4.1 and more Source cves: CVE-2026-33671 Source advisory: SNYK:JS-PICOMATCH-15765511...

4itech-schematics (>=11.3.0-2, <=11.7.0-5), @4itech/schematics (11.7.0) +71 more potentially affected by CVE-2026-33671 via picomatch (3.0.1)

picomatch NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on picomatch and may be impacted: - 4itech-schematics =11.3.0-2, =10.0.0-alpha.1, =10.0.0-alpha.1, =10.0.0-alpha.1, =0.1700.0-rc.3, =0.1700.0-rc.3, =17.0.0-rc.3, =0.1700.0-rc.3,...