org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-rest-cxf (>=4.0.0-m0, <=4.0.7) potentially affected by CVE-2026-78336 via org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic (>=4.0.0-m0, <=4.0.7)

org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.7 Source cves: CVE-2026-78336 Source advisory: MEND:CVE-2026-78336...

@aliceo2/bookkeeping (>=1.19.0, <=1.20.0), @beyondnet/evolith-cli (>=1.2.0, <=1.3.2) +67 more potentially affected by CVE-2026-88932 via multer (>=2.2.0, <=2.3.0)

multer NPM version =2.2.0, =1.19.0, =1.2.0, =1.2.0, =2026.7.0, =5.7.5, =11.1.29-depup.0, =0.1.0, =0.1.0, =11.0.62, =1.2.34, =12.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2026-88932 Source advisory: SNYK:JS-MULTER-19785644...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

PT-2026-91226

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

PT-2026-91235

Description A submitted topology carries two lists of blobstore keys, dependency jars and dependency artifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanu...

Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

ALSA-2026:67161 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

RHEL 10 : git-lfs (RHSA-2026:67149)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67149 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while...

@naologic/design (>=1.0.5, <=1.1.4) potentially affected by unknown CVE via iodash (0.0.1-security)

iodash NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on iodash and may be impacted: - @naologic/design =1.0.5, =1.1.4 Source cves: unknown CVE Source advisory: GHSA-3CFM-82V9-JPJC...

@avorati/strapi-plugin-preview (1.0.1), @catchmexz/fedin-cms (>=5.30.1, <=5.30.2) +13 more potentially affected by CVE-2026-90561 via @strapi/content-manager (>=5.0.0-beta.6, <=5.48.0)

@strapi/content-manager NPM version =5.0.0-beta.6, =5.30.1, =1.0.0, =2.0.0, =2.0.0, =5.0.0-beta.6, =3.0.0-beta.1, =0.1.0, =0.1.4 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2026-90561 Source advisory: SNYK:JS-STRAPICONTENTMANAGER-20158651...

@0xsequence/web3-onboard-plugin (2.0.5), @0xzoz/tallyho (>=2.0.11, <=2.0.14) +1765 more potentially affected by CVE-2026-90771 via joi (>=17.1.1, <=17.13.7)

joi NPM version =17.1.1, =2.0.11, =0.1.6-alpha.2, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.16.17-beta-0213b250, =1.8.31, =1.8.31, =1.8.31, =1.8.31, =1.16.33-beta-20241105-141729-e4608175, =1.17.13-beta-20261019-013222-23d4b329 and more Source cves: CVE-2026-90771 Source advisory:...

@adatechnology/conversation-module (>=0.2.0, <=0.4.3), @adobe/spacecat-shared-brand-client (>=1.1.31, <=1.1.35) +306 more potentially affected by CVE-2026-90771 via joi (>=18.0.0, <=18.2.8)

joi NPM version =18.0.0, =0.2.0, =1.1.31, =1.0.0, =1.8.6, =2.61.4, =1.4.60, =1.6.11, =1.19.1, =1.11.2, =2.2.1, =1.0.0, =1.12.0, =3.14.0, =3.19.0 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-90771 Source advisory: OSV:GHSA-WR44-6HXH-3JWQ...

abscissa (>=0.0.1, <=0.0.4), aingle_zk (>=0.1.0, <=0.9.1) +171 more potentially affected by unknown CVE via clear_on_drop (>=0.2.3, <=0.2.5)

clearondrop CARGO version =0.2.3, =0.0.1, =0.1.0, =4.0.0, =0.12.0, =0.2.0, =1.0.0-pre.0, =0.1.0, =2.0.0, =0.1.0, =5.0.0, =0.1.0-pre.1, =1.0.0 - clarity-vm 2.0.0 - classgroup052 0.5.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0283...

h1-cli-device-browser (>=1.0.1-alpha.0, <=1.0.1-alpha.1), h1-cli-device-node (>=1.0.1-alpha.0, <=1.0.1-alpha.1) potentially affected by unknown CVE via h1-cli-ext-root-openapi-generator (1.0.1-alpha.1)

h1-cli-ext-root-openapi-generator NPM version 1.0.1-alpha.1 is affected by a known vulnerability. The following packages have a transitive dependency on h1-cli-ext-root-openapi-generator and may be impacted: - h1-cli-device-browser =1.0.1-alpha.0, =1.0.1-alpha.0, =1.0.1-alpha.1 Source cves: unkno...

h1-cli-device-node (>=1.0.1-alpha.0, <=1.0.1-alpha.1) potentially affected by unknown CVE via h1-cli-ext-root-auth (1.0.1-alpha.1)

h1-cli-ext-root-auth NPM version 1.0.1-alpha.1 is affected by a known vulnerability. The following packages have a transitive dependency on h1-cli-ext-root-auth and may be impacted: - h1-cli-device-node =1.0.1-alpha.0, =1.0.1-alpha.1 Source cves: unknown CVE Source advisory: GHSA-RQHV-2X39-4CVH...

Security Bulletin: Multiple vulnerabilities that affects Cirata Symphony for IBM Big Replicate

Summary netty-resolver-dns, netty-codec-classes-quic, netty-codec-redis, spring-core, netty-codec-http2, netty-handler, spring-expression, netty-transport-sctp, netty-codec-http3, netty-codec-haproxy, micrometer-core, netty-transport-native-epoll, spring-boot-autoconfigure, netty-codec-http,...

ado-vllm-performance (>=1.2.2, <=1.3.3), caption-flow (>=0.1.0, <=0.5.1) +31 more potentially affected by CVE-2026-90554 via vllm (>=0.10.2, <=0.27.1)

vllm PYPI version =0.10.2, =1.2.2, =0.1.0, =1.0.1rc1, =0.0.4, =0.1.0, =0.3.9.post2, =0.5.2, =1.0.0.dev0, =0.1.0, =0.1.1, =2.5.3, =0.0.2, =0.1.0 and more Source cves: CVE-2026-90554 Source advisory: MEND:CVE-2026-90554...

aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +132 more potentially affected by CVE-2026-90553 via vllm (>=0.1.3, <=0.27.1)

vllm PYPI version =0.1.3, =0.2.1, =1.2.2, =2.3.5.dev0, =0.0.1b1, =0.2.2, =0.2.4, =0.1.0, =0.1.15rc1, =0.1.0, =0.1.0, =0.0.1, =0.0.38 and more Source cves: CVE-2026-90553 Source advisory: SNYK:PYTHON-VLLM-19784402...

GHSA-G6GW-C38X-MQFC vulnerabilities

Vulnerabilities for packages: wazuh-dashboard-fips, librechat, kibana, commercial-gitlab-rails-ee, wazuh-dashboard, commercial-gitlab-rails-ee-fips...

PatchRisk: Forecasting Future Vulnerability Exposure in Open-Source Dependency Networks

Open-source software ecosystems are web-scale dependency networks. A downstream package can become exposed to security risk not because its own source code changes, but because one of its transitive dependencies later receives a vulnerability advisory. Existing vulnerability-detection work often...