a-mailx (=0.1.0), a2a-client-handler (=0.1.0) +366 more potentially affected by CVE-2026-28277 via langgraph (>=0.1.15 <=1.0.1)

langgraph PYPI version =0.1.15, =0.1.5, =0.1.0, =0.1.1, =0.1.1, =0.0.1, =2.1.7, =0.0.2, =0.0.1, =0.1.1, =0.1.2, =0.0.4, =0.5.10 and more Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

a-mailx (=0.1.0), a2a-client-handler (=0.1.0) +429 more potentially affected by CVE-2026-28277 via langgraph (>=0.1.15 <=1.0.10)

langgraph PYPI version =0.1.15, =0.1.5, =0.1.0, =0.1.1, =0.1.1, =0.0.1, =2.1.7, =0.0.2, =0.0.1, =0.1.1, =0.1.2, =0.0.4, =0.5.10 and more Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

ado-vllm-performance (>=1.2.2 <=1.3.3), agentclinic (=0.1.0) +73 more potentially affected by CVE-2026-25048 via xgrammar (>=0.1.11 <=0.1.29)

xgrammar PYPI version =0.1.11, =1.2.2, =0.0.0, =2.3.5, =0.8.4, =0.2.2, =0.2.0, =0.1.0, =1.0.1rc1, =0.0.2, =0.1.1, =0.1.1, =0.0.2, =0.1.0 and more Source cves: CVE-2026-25048 Source advisory: OSV:GHSA-7RGV-GQHR-FXG3...

01os (=0.0.14), 10xscale-agentflow-cli (>=0.3.0 <=0.3.1) +11448 more potentially affected by CVE-2025-69534 via markdown (>=3.0.0 <=3.8.0)

markdown PYPI version =3.0.0, =0.3.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.0.4.80, =4.0.2 - aait-store-cut-part-001 =0.0.1 - aait-store-cut-part-002 =0.0.1 and more Source cves: CVE-2025-69534 Source advisory: SNYK:PYTHON-MARKDOWN-15428352...

django-daiquiri (>=1.3.0 <=1.3.2), django-jwt-allauth (>=1.0.3 <=1.2.0) +13 more potentially affected by CVE-2026-27982 via django-allauth (>=65.0.1 <=65.13.1)

django-allauth PYPI version =65.0.1, =1.3.0, =1.0.3, =0.3.8, =4.0.0, =2.0.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.1.1, =1.1.3 Source cves: CVE-2026-27982 Source advisory: SNYK:PYTHON-DJANGOALLAUTH-15426544...

aleksis (>=2022.6.0.post0 <=2023.6.1), aleksis-app-alsijil (>=2.0.0 <=3.0.1) +97 more potentially affected by CVE-2026-27982 via django-allauth (>=0.24.1 <=65.13.1)

django-allauth PYPI version =0.24.1, =2022.6.0.post0, =2.0.0, =1.0.0, =2.0.0, =2.1.0, =2.0.0, =1.0.0.dev0, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =2.0.0, =1.0.0, =0.1.1, =2.0.0.dev0, =2.0.0.dev2 and more Source cves: CVE-2026-27982 Source advisory: OSV:GHSA-2JPR-83RG-V67J...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which are vulnerable to CVEs.

Summary IBM Maximo Application Suite - IoT Component uses "lz4-java-1.8.0.jar, werkzeug-3.1.3-py3-none-any.whl, urllib3-2.3.0-py3-none-any.whl, urllib3-2.6.0-py3-none-any.whl, urllib3-2.6.2-py3-none-any.whl, pyasn1-0.6.1.tar.gz, github.com/opencontainers/runc v1.1.13,...

com.baomidou:shaun-core (>=1.0 <=1.4), com.baomidou:shaun-spring-boot-starter (>=1.0 <=1.4) +37 more potentially affected by CVE-2026-29000 via org.pac4j:pac4j-jwt (>=4.0.0-RC1 <=4.5.8)

org.pac4j:pac4j-jwt MAVEN version =4.0.0-RC1, =1.0, =1.0, =1.1, =1.1.0, =1.1.1, =1.1.1, =1.1.1, =1.0.0.RELEASE, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.9.0 and more Source cves: CVE-2026-29000 Source advisory: SNYK:JAVA-ORGPAC4J-15428218...

0agent (>=1.0.1 <=1.1.5), 0dot (=0.6.0) +60381 more potentially affected by CVE-2026-29045 via hono (>=4.0.0 <=4.12.3)

hono NPM version =4.0.0, =1.0.1, =1.0.0, =0.1.0, =0.1.0, =0.1.6, =0.1.0, =2.0.0, =1.0.0, =0.3.2, =0.1.0, =0.3.8 and more Source cves: CVE-2026-29045 Source advisory: SNYK:JS-HONO-15419466...

0agent (>=1.0.1 <=1.1.5), 0dot (=0.6.0) +60601 more potentially affected by CVE-2026-29086 via hono (>=0.5.10 <=4.12.3)

hono NPM version =0.5.10, =1.0.1, =1.0.0, =0.1.0, =0.1.0, =0.1.6, =0.1.0, =2.0.0, =1.0.0, =0.3.2, =0.1.0, =0.3.8 and more Source cves: CVE-2026-29086 Source advisory: SNYK:JS-HONO-15418360...

acdc-aws-etl-pipeline (>=0.1.7 <=0.5.9), airflow-dbt-python (=2.1.0) +49 more potentially affected by CVE-2026-29790 via dbt-common (>=0.1.6 <=1.33.0)

dbt-common PYPI version =0.1.6, =0.1.7, =0.1.5, =0.21.7, =0.0.1rc1, =0.1.0a1, =1.0.9, =1.8.0, =1.5.2, =1.8.0, =1.8.0, =1.8.15 and more Source cves: CVE-2026-29790 Source advisory: OSV:GHSA-W75W-9QV4-J5XJ...

@adenta/cms (>=0.0.6 <=1.1.1-0), @adobe/helix-deploy (>=11.0.19 <=11.1.15) +284 more potentially affected by CVE-2026-29786 via tar (>=7.0.0 <=7.5.1)

tar NPM version =7.0.0, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =0.1.1, =0.1.1, =2.17.11, =1.9.5, =8.8.3, =0.0.2, =0.0.22 and more Source cves: CVE-2026-29786 Source advisory: SNYK:JS-TAR-15416075...

org.webjars.npm:canvas (>=2.5.0 <=2.6.0), org.webjars.npm:color-thief (=2.2.5) +12 more potentially affected by CVE-2026-29786 via org.webjars.npm:tar (>=0.1.20 <=4.4.19)

org.webjars.npm:tar MAVEN version =0.1.20, =2.5.0, =0.97.5, =0.2.0, =3.4.0, =0.6.19, =2.0.0, =3.1.4, =3.4.1 - org.webjars.npm:tar.gz =1.0.7 Source cves: CVE-2026-29786 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15416076...

com.efluid.oss:efluid-datagate-app (>=3.1.3 <=6.1.5), com.efluid.oss:efluid-datagate-app-cucumber (>=3.1.3 <=6.1.5) +5 more potentially affected by CVE-2026-29000 via org.pac4j:pac4j-jwt (>=5.0.1 <=5.7.8)

org.pac4j:pac4j-jwt MAVEN version =5.0.1, =3.1.3, =3.1.3, =0.8.0, =0.8.0, =2.0.6, =2.2.1, =2.0.6, =2.1.0 Source cves: CVE-2026-29000 Source advisory: OSV:GHSA-PM7G-W2CF-Q238...

cc.akkaha:asura-play_2.12 (>=0.5.0 <=0.6.0), cc.akkaha:pea_2.12 (>=0.1.0 <=0.7.0) +305 more potentially affected by CVE-2026-29000 via org.pac4j:pac4j-jwt (>=1.8.2 <=4.5.8)

org.pac4j:pac4j-jwt MAVEN version =1.8.2, =0.5.0, =0.1.0, =1.0, =1.0, =1.1, =1.1.0, =1.1.1, =1.1.1, =1.1.1, =1.0.0-beta-21, =1.0.0-beta-21, =1.0.0.RELEASE, =0.2.0, =0.2.0, =0.2.0, =0.9.0 and more Source cves: CVE-2026-29000 Source advisory: OSV:GHSA-PM7G-W2CF-Q238...

02url-querystring-http (>=1.0.1 <=1.0.4), 1-0-5-hai-aage-dekhte-hein-kya-aat-hai (>=1.0.5 <=1.0.6) +12772 more potentially affected by CVE-2026-3520 via multer (>=0.0.5 <=2.1.0)

multer NPM version =0.0.5, =1.0.1, =1.0.5, =2.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =1.0.0, =1.0.3 - 6e-alpha-backend-admin =1.0.0 and more Source cves: CVE-2026-3520 Source advisory: OSV:GHSA-5528-5VMV-3XC2...

@backstage/backend-defaults (>=0.0.0-nightly-20240929023448 <=0.15.2-next.1), @backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20240929023448 <=0.7.9-next.1) +78 more potentially affected by CVE-2026-29185 via @backstage/integration (>=1.15.0 <=1.20.0)

@backstage/integration NPM version =1.15.0, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20250614024041, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20250129022746, =0.0.0-nightly-20250129022746, =0.0.0-nightly-20250129022746,...

osbuild-composer security update

149-5.0.1 - Add missing dependency over dracut-config-rescue for image-installer Orabug: 38587453 - Add OL10 support - Update repository URLs for baseos, appstream and UERK - Fix the label for UEKR repository - Simplify repository names JIRA: OLDIS-35893 - Ensure build on latest golang:...

5ug-cli (>=1.0.68 <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3 <=0.4.2) +218 more potentially affected by CVE-2026-29074 via svgo (>=3.0.0 <=3.3.2)

svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-29074 Source advisory: SNYK:JS-SVGO-15423912...

5ug-cli (>=1.0.72 <=1.4.0), @343dev/optimizt (=6.0.0) +87 more potentially affected by CVE-2026-29074 via svgo (>=2.1.0 <=2.8.0)

svgo NPM version =2.1.0, =1.0.72, =1.1.2, =2.0.0, =0.0.2-0, =4.55.0, =2.12.3-canary.621.15219.0, =2.1.0, =2.1.0, =2.1.8, =5.0.0, =0.0.1, =2.7.4, =1.0.1, =1.3.9 and more Source cves: CVE-2026-29074 Source advisory: OSV:GHSA-XPQW-6GX7-V673...