cn.angis.warm-flow-beetlsql:warm-flow-beetlsql-sb-starter (>=1.6.9.1 <=1.8.4.0), cn.angis.warm-flow-beetlsql:warm-flow-beetlsql-sb-test (>=1.6.9.1 <=1.7.2.3) +36 more potentially affected by CVE-2026-6125 via org.dromara.warm:warm-flow-plugin-modes-sb (>=1.3.4 <=1.8.5)

org.dromara.warm:warm-flow-plugin-modes-sb MAVEN version =1.3.4, =1.6.9.1, =1.6.9.1, =1.6.8.1, =4.0.0, =2025.13.0, =2025.3.2, =1.6.6, =1.8.4 - org.dromara.warm-flow-mybatis-flex:warm-flow-mybatis-flex-sb-test =1.6.6 and more Source cves: CVE-2026-6125 Source advisory:...

ai.catboost:catboost-spark_4.0_2.13 (=1.2.10), ai.catboost:catboost-spark_4.1_2.13 (=1.2.10) +7315 more potentially affected by CVE-2026-34478 via org.apache.logging.log4j:log4j-core (>=2.21.0 <=2.25.3)

org.apache.logging.log4j:log4j-core MAVEN version =2.21.0, =0.27.0, =0.26.0, =3.10.0.5, =2.6.0-looktech.1, =2.6.0-looktech.1, =2.6.0-looktech.1, =2.6.0-looktech.1, =2.6.0-looktech.1, =2.6.0-looktech.1, =2.6.0-looktech.1, =3.0.0, =2.12.1, =2.12.3 and more Source cves: CVE-2026-34478 Source advisor...

aac (>=0.4.24 <=0.5.21), aac-gen-gherkin (>=0.1.0 <=0.1.4) +1590 more potentially affected by CVE-2026-39892 via cryptography (>=45.0.0 <=46.0.6)

cryptography PYPI version =45.0.0, =0.4.24, =0.1.0, =0.1.3, =0.0.1, =0.1.5, =0.1.1, =2.4.119, =0.10.2.4rc3, =3.2.1, =0.2.0, =0.3.4, =0.0.2, =0.0.6, =0.0.21 and more Source cves: CVE-2026-39892 Source advisory: OSV:GHSA-P423-J2CM-9VMQ...

openwebui-token-tracking (=0.1.7) potentially affected by CVE-2026-28786 via open-webui (=0.6.0)

open-webui PYPI version =0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking =0.1.7 Source cves: CVE-2026-28786 Source advisory: SNYK:PYTHON-OPENWEBUI-15855399...

org.webjars.npm:github-com-cisco-node-jose (=2.2.0), org.webjars.npm:google-auth-library (>=1.6.1 <=6.1.6) +7 more potentially affected by CVE-2026-33891 via org.webjars.npm:node-forge (>=0.10.0 <=1.3.3)

org.webjars.npm:node-forge MAVEN version =0.10.0, =1.6.1, =1.0.2, =2.3.2, =1.10.2, =2.1.1 Source cves: CVE-2026-33891 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15789770...

com.sap.hcp.cf.logging:sample-app-spring-boot (>=3.8.0 <=4.1.0), com.weibo:rill-flow-service (>=0.1.3 <=0.1.18) +159 more potentially affected by CVE-2026-33701 via io.opentelemetry.javaagent:opentelemetry-javaagent (>=0.12.1 <=2.23.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version =0.12.1, =3.8.0, =0.1.3, =4.0.0-alpha1, =1.9.0, =0.0.10, =0.2.1, =0.6.2, =0.6.2, =0.80.0, =0.80.0, =0.19.0, =2.5.0, =1.9.0, =1.9.0, =2.3.0 and more Source cves: CVE-2026-33701 Source advisory: OSV:GHSA-XW7X-H9FJ-P2C7...

01os (>=0.0.5 <=0.0.13), 3m (>=0.1.0 <=0.1.3) +2585 more potentially affected by CVE-2026-33699 via pypdf (>=3.10.0 <=6.9.1)

pypdf PYPI version =3.10.0, =0.0.5, =0.1.0, =0.0.1, =0.2.0, =0.4.0, =0.3.0, =0.3.0, =0.1.1, =0.1.0, =0.0.2, =0.2.0, =1.2.27, =3.0.145 and more Source cves: CVE-2026-33699 Source advisory: OSV:GHSA-87MJ-5GGW-8QC3...

axondeepseg (>=5.0.2 <=5.5.0rc2), bids-manager (>=0.1.0 <=1.0.0) +22 more potentially affected by CVE-2026-32711 via pydicom (>=3.0.0rc1 <=3.0.1)

pydicom PYPI version =3.0.0rc1, =5.0.2, =0.1.0, =1.0.0, =0.1.0, =0.1.8, =0.0.8, =0.0.12 and more Source cves: CVE-2026-32711 Source advisory: OSV:GHSA-V856-2RF8-9F28...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0 <=8.8.1), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.6.5 <=7.4.5) +234 more potentially affected by CVE-2026-33180 via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (>=0.0.1 <=6.8.2)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version =0.0.1, =4.0.0, =5.6.5, =4.1.0, =4.0.0, =4.1.0, =4.0.0, =5.0.0, =4.0.0, =5.3.0, =6.2.0, =5.1.0, =6.8.0, =6.4.0, =5.3.0, =4.0.0, =5.5.7 and more Source cves: CVE-2026-33180 Source advisory: OSV:GHSA-P7M9-V2CM-2H7M...

@aabelmann/ui-layer (=0.0.1), @adinvadim/convex-vue (>=1.1.0 <=1.3.0) +734 more potentially affected by CVE-2026-30226 via devalue (>=4.0.1 <=5.6.3)

devalue NPM version =4.0.1, =1.1.0, =1.0.0, =0.0.1, =0.1.0, =0.2.2, =0.2.2, =0.2.2, =0.3.0, =0.5.7, =0.0.1-beta.3, =0.0.1-alpha.1, =0.0.17, =0.0.2, =0.0.10 and more Source cves: CVE-2026-30226 Source advisory: SNYK:JS-DEVALUE-15467451...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-32896 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-32896 Source advisory: OSV:GHSA-5MX2-2MGW-X8RM...

@andreacioni/saml2-nest-lib (=0.0.7), @apps-in-toss/web-framework (>=2.0.0 <=2.6.2) +220 more potentially affected by CVE-2026-2880 via @fastify/middie (>=8.0.0 <=9.1.0)

@fastify/middie NPM version =8.0.0, =2.0.0, =1.1.6, =1.0.5, =0.2.5, =0.0.6, =0.0.1, =0.0.1, =4.33.5, =2.0.7, =0.0.0-canary-20240602190113, =0.0.0-canary-20240602190113, =0.1.0, =0.7.1 and more Source cves: CVE-2026-2880 Source advisory: OSV:GHSA-8P85-9QPW-FWGW...

a-mailx (=0.1.0), aaaai (>=0.1.3 <=0.3.0) +22 more potentially affected by CVE-2026-25528 via langsmith (>=0.4.11 <=0.6.2)

langsmith PYPI version =0.4.11, =0.1.3, =0.1.3, =2.1.7, =0.1.3, =3.0.0, =0.1.4, =1.0.2, =0.1.0, =0.1.0, =0.2.1, =0.2.2 and more Source cves: CVE-2026-25528 Source advisory: SNYK:PYTHON-LANGSMITH-15253026...

a2cli (>=0.1.0 <=0.2.1), a2py (>=0.2.1 <=0.2.3) +686 more potentially affected by CVE-2026-25580 via pydantic-ai-slim (>=0.0.26 <=1.55.0)

pydantic-ai-slim PYPI version =0.0.26, =0.1.0, =0.2.1, =0.9.0, =0.1.0, =0.2.15, =0.1.0, =0.0.1.dev1, =0.1.0, =0.0.4, =0.1.0, =0.2.5, =0.1.0, =0.0.3, =1.0.3 and more Source cves: CVE-2026-25580 Source advisory: OSV:GHSA-2JRP-274C-JHV3...

org.apache.syncope.client.am:syncope-client-am-console (>=3.0.0 <=3.0.15), org.apache.syncope.client.idm:syncope-client-idm-console (>=3.0.0 <=3.0.15) +5 more potentially affected by CVE-2026-23795 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=3.0.0-M0 <=3.0.15)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =3.0.0-M0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.15 Source cves: CVE-2026-23795 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECLIENTIDREPO-15202477...

@activepieces/piece-snowflake (>=0.2.1 <=0.3.0), @bhanu17/nextjs-starter (>=1.2.0 <=2.2.14) +92 more potentially affected by CVE-2026-3449 via @tootallnate/once (=2.0.0)

@tootallnate/once NPM version =2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @tootallnate/once and may be impacted: - @activepieces/piece-snowflake =0.2.1, =1.2.0, =0.0.18, =0.2.0, =0.0.6, =0.0.1, =50.32.5-depup.0, =0.6.0, =0.4.2, =0.1.10,...

flowflops (>=0.0.1.post2211140919 <=0.0.1.post2211151211) potentially affected by CVE-2025-71004 via oneflow (=0.9.0)

oneflow PYPI version =0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on oneflow and may be impacted: - flowflops =0.0.1.post2211140919, =0.0.1.post2211151211 Source cves: CVE-2025-71004 Source advisory: SNYK:PYTHON-ONEFLOW-15162566...

com.github.liuyueyi.media:svg-core (>=2.5 <=3.0.0) potentially affected by CVE-2026-24806 via com.github.liuyueyi.media:batik-codec-fix (>=2.5 <=3.0.0)

com.github.liuyueyi.media:batik-codec-fix MAVEN version =2.5, =2.5, =3.0.0 Source cves: CVE-2026-24806 Source advisory: OSV:GHSA-8623-9FWR-4CXV...

Malicious code in uitil (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ff0b75197d8e7cd361d61461260811fba8920c54b8538cb5f21ec2fc1c885ec3 The package implements an undocumented way to execute code hidden in image files, and a function that searches for images in the current directory and attempts...

ai.tock:bot-test (>=25.9.0 <=26.3.2), ai.tock:bot-test-base (>=25.9.0 <=26.3.2) +832 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (>=5.0.0.CR1 <=5.0.6)

io.vertx:vertx-core MAVEN version =5.0.0.CR1, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =26.3.2 and more Source cves: CVE-2026-1002 Source advisory: OSV:GHSA-CPHF-4846-3XX9...