au.csiro.pathling:encoders (>=6.2.2 <=9.6.0), au.csiro.pathling:fhir-server (>=6.2.2 <=7.2.0) +220 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (>=6.0.0 <=6.9.6)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version =6.0.0, =6.2.2, =6.2.2, =6.2.2, =6.2.2, =6.2.2, =6.2.2, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.10.0 and more Source cves: CVE-2026-45367 Source advisory: SNYK:JAVA-CAUHNHAPIFHIR-16757888...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.6.0 <=8.10.0), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.6.0 <=7.4.5) +182 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (>=6.0.0 <=6.9.5)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.4.0, =8.10.0 and more Source cves: CVE-2026-45367 Source advisory: SNYK:JAVA-CAUHNHAPIFHIR-16757890...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (=6.8.0), ca.uhn.hapi.fhir:hapi-fhir-base-test-mindeps-client (>=6.6.0 <=7.4.5) +197 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (>=6.0.0 <=6.9.5)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.10.0 and more Source cves: CVE-2026-45367 Source advisory: SNYK:JAVA-CAUHNHAPIFHIR-16757886...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0 <=8.10.0), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.6.5 <=7.4.5) +223 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (>=1.0.0 <=6.9.4.1)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version =1.0.0, =4.0.0, =5.6.5, =4.1.0, =4.1.0, =4.0.0, =5.0.0, =4.0.0, =5.3.0, =6.2.0, =5.1.0, =6.8.0, =6.4.0, =5.3.0, =4.0.0, =4.0.0, =8.10.0 and more Source cves: CVE-2026-45367 Source advisory: OSV:GHSA-3653-68V6-RQ57...

ai-plays-jackbox (>=0.0.1 <=0.3.2), air-link (>=0.0.0 <=0.5.0) +74 more potentially affected by CVE-2026-45554 via nicegui (>=0.9.11 <=3.10.0)

nicegui PYPI version =0.9.11, =0.0.1, =0.0.0, =0.1.0, =1.1.3, =1.9.5, =0.3.0, =0.0.1, =0.6.7, =1.0.0, =1.2.0, =1.23.0 and more Source cves: CVE-2026-45554 Source advisory: OSV:GHSA-PQ7C-X8G4-RVP6...

ai-plays-jackbox (>=0.0.1 <=0.3.2), air-link (>=0.0.0 <=0.5.0) +74 more potentially affected by CVE-2026-45553 via nicegui (>=0.9.11 <=3.10.0)

nicegui PYPI version =0.9.11, =0.0.1, =0.0.0, =0.1.0, =1.1.3, =1.9.5, =0.3.0, =0.0.1, =0.6.7, =1.0.0, =1.2.0, =1.23.0 and more Source cves: CVE-2026-45553 Source advisory: OSV:GHSA-JFRM-RX66-G536...

crm-automator (>=1.9.5 <=1.11.5), ex4nicegui (=0.9.0) +3 more potentially affected by CVE-2026-45553 via nicegui (>=3.0.4 <=3.10.0)

nicegui PYPI version =3.0.4, =1.9.5, =1.0.0, =12.22.3, =12.22.5 Source cves: CVE-2026-45553 Source advisory: SNYK:PYTHON-NICEGUI-16757863...

-fides-amor-et-lux (=1.0.0), -price-checker (>=1.0.0 <=1.0.5) +35597 more potentially affected by CVE-2026-45736 via ws (>=8.0.0 <=8.20.0)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =1.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vibekit =0.1.0 - 0g-zksettlement-client =1.0.0 and more Source cves: CVE-2026-45736 Source advisory: OSV:GHSA-58QX-3VCG-4XPX...

1claw-crewai-tools (=0.1.0), 4dpocket (>=0.1.3 <=0.1.4) +1555 more potentially affected by CVE-2026-45829 via chromadb (>=1.0.0 <=1.5.9)

chromadb PYPI version =1.0.0, =0.1.3, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.2.0, =0.6.4, =0.0.4, =0.1.0, =3.0.1 and more Source cves: CVE-2026-45829 Source advisory: OSV:GHSA-F4J7-R4Q5-QW2C...

5htp-airtable (>=0.0.1 <=0.1.2-3), @a-cube-io/ereceipts-js-sdk (=1.1.0) +147 more potentially affected by CVE-2025-57282 via ngrok (=5.0.0-beta.2)

ngrok NPM version =5.0.0-beta.2 is affected by a known vulnerability. The following packages have a transitive dependency on ngrok and may be impacted: - 5htp-airtable =0.0.1, =1.0.0, =5.0.0, =1.0.0, =3.1.6, =1.4.4, =1.0.0, =1.3.2, =1.0.31, =1.0.0, =1.0.26, =1.0.2, =1.1.0 and more Source cves:...

@addtodoist/twitter-autohook (=2.2.0), @alessiodf/core-chameleon (=0.0.1) +156 more potentially affected by CVE-2025-57282 via ngrok (=4.3.3)

ngrok NPM version =4.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on ngrok and may be impacted: - @addtodoist/twitter-autohook =2.2.0 - @alessiodf/core-chameleon =0.0.1 - @archer-edu/qa-test-cli =0.1.0, =0.1.1, =3.8.2, =3.0.0, =3.0.0-alpha.9, =1.0....

@aaa-backend-stack/graphql-rest-bindings (>=1.16.0 <=1.16.9), @aaa-backend-stack/image-service (>=1.16.0 <=1.16.9) +590 more potentially affected by CVE-2026-8159 via multiparty (>=4.0.0 <=4.2.3)

multiparty NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =0.1.155, =1.0.0, =1.1.0, =0.0.1, =0.0.1, =0.1.0, =0.58.14, =0.1.0, =1.0.0, =2.101.2 and more Source cves: CVE-2026-8159 Source advisory: SNYK:JS-MULTIPARTY-16790693...

@aaa-backend-stack/graphql-rest-bindings (>=1.16.0 <=1.16.9), @aaa-backend-stack/image-service (>=1.16.0 <=1.16.9) +590 more potentially affected by CVE-2026-8161 via multiparty (>=4.0.0 <=4.2.3)

multiparty NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =0.1.155, =1.0.0, =1.1.0, =0.0.1, =0.0.1, =0.1.0, =0.58.14, =0.1.0, =1.0.0, =2.101.2 and more Source cves: CVE-2026-8161 Source advisory: SNYK:JS-MULTIPARTY-16790691...

ai.evolv:ascend-sdk (=0.5.0), app.peac:core (=0.0.1) +2551 more potentially affected by CVE-2026-45300 via org.asynchttpclient:async-http-client (>=2.0.0 <=2.14.5)

org.asynchttpclient:async-http-client MAVEN version =2.0.0, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.7.0, =0.7.0, =0.1.0, =0.2.0, =0.1.0, =0.2.0, =2.2, =2.0, =2.0-RC2 and more Source cves: CVE-2026-45300 Source advisory: OSV:GHSA-FMXF-PM6P-7XGM...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1 <=6.0.1-rc.1), com.cloudbees.thirdparty:zendesk-java-client (>=1.1.0 <=1.3.1) +50 more potentially affected by CVE-2026-45300 via org.asynchttpclient:async-http-client (>=3.0.0.Beta1 <=3.0.1)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.Beta1, =6.0.1, =1.1.0, =0.4.8, =0.4.8, =0.4.8, =218.0.0, =14.5.0, =15.4.0 - com.navercorp.pinpoint:pinpoint-agentstatistics-collector =3.1.0 - com.navercorp.pinpoint:pinpoint-batch =3.1.0 - com.navercorp.pinpoint:pinpoint-collector-starte...

@aws/nx-plugin (>=0.105.0 <=1.0.0-rc.2), @breadstone-infrastructure/nx-tasks (>=0.0.237 <=0.0.289) +42 more potentially affected by CVE-2026-45149 via brace-expansion (>=5.0.2 <=5.0.5)

brace-expansion NPM version =5.0.2, =0.105.0, =0.0.237, =0.0.237, =22.7.0, =22.7.0, =22.7.0, =22.7.0, =22.7.0, =22.7.0, =22.7.0, =22.7.0, =22.7.0, =22.7.0, =22.7.0, =23.0.0-pr.35465.2bc2643 and more Source cves: CVE-2026-45149 Source advisory: OSV:GHSA-JXXR-4GWJ-5JF2...

01os (>=0.0.5 <=0.0.13), 1claw-crewai-tools (=0.1.0) +1819 more potentially affected by CVE-2026-45829 via chromadb (>=0.3.21 <=1.5.9)

chromadb PYPI version =0.3.21, =0.0.5, =0.1.3, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.2.0, =0.6.4, =0.0.4, =0.0.4.dev0 - adaline-crewai =0.1.0 - adam-thinking =1.0.0 and more Source cves: CVE-2026-45829 Source advisory: SNYK:PYTHON-CHROMADB-16758047...

EUVD-2026-30561

Microsoft APM: Symlinks under .apm/prompts/ and .apm/agents/ are dereferenced during apm install, copying host-local file contents into the project tree...

Security update for cloud-init

This update for cloud-init fixes the following issues: Update to version 25.1.3 bsc1245403, CVE-2024-11584, CVE-2024-6174 Update to version 25.1.1 bsc1239715, jscPED-8680, bsc1228414, bsc1237764 Make sure a directory exists, if not create it, before writing in that location bsc1236720 rsyslog...

0pflow (>=0.1.0 <=0.1.0-dev.f5622ac), 0xble (>=14.0.0 <=23.2.2) +9001 more potentially affected by CVE-2026-8768 via ai (>=0.0.0-b66d09a8-20260328011513 <=7.0.0-canary.168)

ai NPM version =0.0.0-b66d09a8-20260328011513, =0.1.0, =14.0.0, =1.1.5, =1.0.0, =0.2.14, =0.1.6, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.1.0, =1.1.0, =0.1.0-alpha.1, =0.6.0, =0.1.0, =0.1.29 and more Source cves: CVE-2026-8768 Source advisory: SNYK:JS-AI-16734889...