org.webjars.npm:canvas (>=2.5.0 <=2.6.0), org.webjars.npm:color-thief (=2.2.5) +12 more potentially affected by CVE-2026-26960 via org.webjars.npm:tar (>=0.1.20 <=4.4.19)

org.webjars.npm:tar MAVEN version =0.1.20, =2.5.0, =0.97.5, =0.2.0, =3.4.0, =0.6.19, =2.0.0, =3.1.4, =3.4.1 - org.webjars.npm:tar.gz =1.0.7 Source cves: CVE-2026-26960 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15307073...

0pflow (>=0.1.0-dev.0de2bc6 <=0.1.0-dev.f5622ac), 10t-images-to-pdf (=1.0.3) +13826 more potentially affected by CVE-2026-26960 via tar (>=7.0.0 <=7.5.7)

tar NPM version =7.0.0, =0.1.0-dev.0de2bc6, =0.2.0, =0.0.1, =3.1.2, =1.0.1, =4.11.0, =1.0.1, =1.31.1, =2.0.0, =0.1.0, =0.1.0, =1.7.0-beta.7, =1.7.0-beta.58 - @0x706b/tsplus-installer =0.0.190 and more Source cves: CVE-2026-26960 Source advisory: SNYK:JS-TAR-15307072...

nodejs:22 security update

nodejs 1:22.22.0-1 - Update to 22.22.0 Resolves: RHEL-141879 nodejs-nodemon 3.0.1-1 - Rebase to 3.0.1 - Resolves: CVE-2022-25883 2.0.20-2 - Patch bundled glob-parent - Resolves: CVE-2021-35065 2.0.20-1 - Rebase to 2.0.20 Resolves: CVE-2022-3517 2.0.15-1 - Resolves: RHBZ2005419 - Resolves...

@1sat/actions (>=0.0.1 <=0.0.166), @1sat/cli (>=0.0.56 <=0.0.69) +163 more potentially affected by CVE-2025-69287 via @bsv/sdk (>=1.10.1 <=1.9.24)

@bsv/sdk NPM version =1.10.1, =0.0.1, =0.0.56, =0.0.3, =0.0.3, =0.0.1, =0.0.1, =0.0.3, =0.0.47, =0.0.3, =0.0.2, =0.0.1, =0.1.0, =0.1.8, =0.2.15, =0.2.75 and more Source cves: CVE-2025-69287 Source advisory: OSV:GHSA-VJPQ-XX5G-QVMM...

RHSA-2026:2726 Red Hat Security Advisory: pki-deps:10.6 security update

Bulletin has no description...

RHSA-2026:2725 Red Hat Security Advisory: pki-deps:10.6 security update

Bulletin has no description...

nodejs:24 security update

nodejs 1:24.13.0-1 - Update to version 24.13.0 nodejs-nodemon 3.0.3-3 - Keep BR on just npm 3.0.3-2 - Fix BR for nodejs-npm nodejs-packaging 2021.06-6 - Properly handle @group/package deps in nodejs-symlink-deps Resolves: RHEL-121581 2021.06-5 - nodejs.req to properly detect bundled deps...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0 <=10.0.0-M3), org.apache.tomee.bom:tomee-plume (>=10.0.0 <=10.0.0-M3) +2 more potentially affected by CVE-2026-24734 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30 <=10.1.49)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.1.3 Source cves: CVE-2026-24734 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-15307823...

@anngdinh/remote-mcp-server-authless (=0.0.0), @aredes.me/mcp-camara (=1.0.6) +141 more potentially affected by unknown CVE via agents (>=0.0.100 <=0.2.35)

agents NPM version =0.0.100, =0.4.0, =1.1.1, =0.1.0, =0.2.0, =0.1.0, =0.0.1, =2.1.6, =0.0.1, =1.1.1, =1.3.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W5CR-2QHR-JQC5...

@jamietanna/renovate-graph (=0.36.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (=3.1.1) potentially affected by unknown CVE via renovate (>=42.92.4 <=42.92.5)

renovate NPM version =42.92.4, =42.92.5 is affected by a known vulnerability. The following packages have a transitive dependency on renovate and may be impacted: - @jamietanna/renovate-graph =0.36.0 - @secustor/backstage-plugin-renovate-backend-module-runtime-direct =3.1.1 Source cves: unknown C...

@secustor/backstage-plugin-renovate-backend-module-runtime-direct (>=4.0.0 <=4.0.2), renovate-mcp (>=0.11.0 <=1.0.2) potentially affected by unknown CVE via renovate (>=43.118.0 <=43.46.0)

renovate NPM version =43.118.0, =4.0.0, =0.11.0, =1.0.2 Source cves: unknown CVE Source advisory: SNYK:JS-RENOVATE-15282784...

@jamietanna/renovate-graph (=0.36.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (=3.1.1) potentially affected by unknown CVE via renovate (>=42.92.4 <=42.92.5)

renovate NPM version =42.92.4, =42.92.5 is affected by a known vulnerability. The following packages have a transitive dependency on renovate and may be impacted: - @jamietanna/renovate-graph =0.36.0 - @secustor/backstage-plugin-renovate-backend-module-runtime-direct =3.1.1 Source cves: unknown C...

openmls (>=0.4.0-pre.1 <=0.4.0-pre.2), openmls_evercrypt (>=0.1.0-pre.1 <=0.1.0-pre.2) +2 more potentially affected by unknown CVE via hpke-rs (=0.1.2)

hpke-rs CARGO version =0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on hpke-rs and may be impacted: - openmls =0.4.0-pre.1, =0.1.0-pre.1, =0.1.0, =0.3.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:GHSA-G433-PQ76-6CMF...

acryl-datahub-gx-plugin (>=0.14.0.3 <=0.15.0rc15), agnostic (=1.0.3) +550 more potentially affected by unknown CVE via sqlparse (>=0.1.14 <=0.5.3)

sqlparse PYPI version =0.1.14, =0.14.0.3, =0.2.0, =0.0.1, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.0.36, =2.1.1.3, =1.0.0, =1.0.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-27JP-WM6Q-GP25...

Security update for cargo-auditable

This update for cargo-auditable fixes the following issues: Update to version 0.7.20. Security issues fixed: CVE-2026-25727: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion bsc1257906. Other updates and bugfixes: Update to version 0.7.20: mention cargo-dist...

@anngdinh/remote-mcp-server-authless (=0.0.0), @aredes.me/mcp-camara (=1.0.6) +141 more potentially affected by CVE-2026-1721 via agents (>=0.0.100 <=0.2.35)

agents NPM version =0.0.100, =0.4.0, =1.1.1, =0.1.0, =0.2.0, =0.1.0, =0.0.1, =2.1.6, =0.0.1, =1.1.1, =1.3.4 and more Source cves: CVE-2026-1721 Source advisory: OSV:GHSA-CVHV-6XM6-C3V4...

@anngdinh/remote-mcp-server-authless (=0.0.0), @aredes.me/mcp-camara (=1.0.6) +141 more potentially affected by CVE-2026-1721 via agents (>=0.0.100 <=0.2.35)

agents NPM version =0.0.100, =0.4.0, =1.1.1, =0.1.0, =0.2.0, =0.1.0, =0.0.1, =2.1.6, =0.0.1, =1.1.1, =1.3.4 and more Source cves: CVE-2026-1721 Source advisory: SNYK:JS-AGENTS-15279200...

dokuwiki-autodoc (>=0.0.8 <=1.6.2), ocx-common (>=1.2.5 <=2.7.0) +2 more potentially affected by CVE-2019-25338 via dokuwiki (=1.3.3)

dokuwiki PYPI version =1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on dokuwiki and may be impacted: - dokuwiki-autodoc =0.0.8, =1.2.5, =2.7.0 - ocx-reader =0.1.0 - ocx-schema-parser =2.0.1 Source cves: CVE-2019-25338 Source advisory:...

@devix-tecnologia/utils-ts (=1.0.0), @directus/api (>=15.0.0 <=32.2.0) +3 more potentially affected by CVE-2026-26185 via directus (>=10.10.0 <=11.14.0)

directus NPM version =10.10.0, =15.0.0, =1.2.2, =1.0.0, =2.0.0 - directus-extension-blog-year-filter =1.0.0 Source cves: CVE-2026-26185 Source advisory: OSV:GHSA-JR94-GJ3H-C8RF...

@bicou/directus-extension-imagga (>=1.6.3 <=1.6.6), @deconz-community/directus-extension-ddf-store (=0.1.0) +7 more potentially affected by CVE-2026-26185 via @directus/api (>=10.0.0 <=32.1.1)

@directus/api NPM version =10.0.0, =1.6.3, =1.2.2, =10.0.0, =1.0.0, =2.0.0 - directus-extension-blog-year-filter =1.0.0 Source cves: CVE-2026-26185 Source advisory: OSV:GHSA-JR94-GJ3H-C8RF...