@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +42 more potentially affected by CVE-2026-88057 via @angular/core (>=20.0.0, <=20.3.25)

@angular/core NPM version =20.0.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.5-snapshot-1748673884997, =19.2.5-snapshot-1748673884997, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.27), @angelmartz/template-drawer-navigation-ng (9.1.0) +16 more potentially affected by CVE-2026-88057 via @angular/compiler (>=22.0.0, <=22.0.8)

@angular/compiler NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.0-workstream-forge.3, =0.0.0-workstream-forge.12, =0.0.0-workstream-forge.31 and more Source cves: CVE-2026-88057 Source advisory:...

@africanies/angular-web-sdk (>=0.1.0, <=0.1.27), @angelmartz/template-drawer-navigation-ng (9.1.0) +16 more potentially affected by CVE-2026-88057 via @angular/compiler (>=22.0.0, <=22.0.8)

@angular/compiler NPM version =22.0.0, =0.1.0, =6.1.210-alpha, =6.1.210-alpha, =0.0.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =0.0.0, =0.0.0-workstream-forge.3, =0.0.0-workstream-forge.12, =0.0.0-workstream-forge.31 and more Source cves: CVE-2026-88057 Source advisory:...

@absolutejs/absolute (0.12.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +34 more potentially affected by CVE-2026-88057 via @angular/compiler (>=20.0.0, <=20.3.21)

@angular/compiler NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.5-snapshot-1748673884997, =19.2.5-snapshot-1748673884997, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =0.0.57, =0.0.60 - @saritasa/renewaire-frontend-sdk 0.1.0-dev.101 and more Source cves: CVE-2026-88057 Source advisory:...

ai.driftkit:driftkit-context-engineering-spring-ai-starter (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-context-engineering-spring-boot-starter (>=0.5.0, <=0.9.2) +1523 more potentially affected by CVE-2026-88033 via org.mongodb:mongodb-driver-sync (>=5.0.0-beta0, <=5.11.0)

org.mongodb:mongodb-driver-sync MAVEN version =5.0.0-beta0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =0.5.0, =24.3.0, =24.3.0, =24.3.0, =24.3.0, =26.3.4 and more Source cves: CVE-2026-88033 Source advisory: MEND:CVE-2026-88033...

classy-core (>=0.2.1.dev20220303, <=0.2.1), open-metric-learning (>=0.3.0, <=0.3.6) potentially affected by CVE-2024-5452 via pytorch-lightning (1.5.9)

pytorch-lightning PYPI version 1.5.9 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - classy-core =0.2.1.dev20220303, =0.3.0, =0.3.6 Source cves: CVE-2024-5452 Source advisory: OSV:PYSEC-2026-3974...

pytorch-segmentation-models-trainer (0.11.0) potentially affected by CVE-2024-5452 via pytorch-lightning (1.4.3)

pytorch-lightning PYPI version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.11.0 Source cves: CVE-2024-5452 Source advisory: OSV:PYSEC-2026-3974...

nemo-toolkit (1.0.0rc1) potentially affected by CVE-2024-5980 via pytorch-lightning (1.1.5)

pytorch-lightning PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - nemo-toolkit 1.0.0rc1 Source cves: CVE-2024-5980 Source advisory: OSV:PYSEC-2026-3975...

cait (1.1.3), contextualized-ml (>=0.2.5, <=0.2.6) +4 more potentially affected by CVE-2024-5980 via pytorch-lightning (1.9.4)

pytorch-lightning PYPI version 1.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - cait 1.1.3 - contextualized-ml =0.2.5, =0.3.0, =0.1.0, =0.2.0 Source cves: CVE-2024-5980 Source advisory: OSV:PYSEC-2026-3975...

chemprobe (0.1.1), dlk (>=0.0.6, <=0.0.10) potentially affected by CVE-2024-5980 via pytorch-lightning (1.5.8)

pytorch-lightning PYPI version 1.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - chemprobe 0.1.1 - dlk =0.0.6, =0.0.10 Source cves: CVE-2024-5980 Source advisory: OSV:PYSEC-2026-3975...

asteroid (>=0.6.1rc0, <=0.6.1), autogluon (>=0.5.3b20221006, <=0.5.3) +28 more potentially affected by CVE-2024-5452 via pytorch-lightning (1.7.7)

pytorch-lightning PYPI version 1.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - asteroid =0.6.1rc0, =0.5.3b20221006, =0.5.3b20221006, =0.5.3b20221006, =0.5.3b20221029, =0.0.1, =0.2.0, =2.2.4.5, =0.0.1,...

hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-88006 via open-webui (0.11.0)

open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-88006 Source advisory: MEND:CVE-2026-88006...

CVE-2026-88884 Renovate before 44.3.1 Authentication Bypass via Digest Updates

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...

CVE-2026-88882 Renovate before 44.11.2 Credential Exfiltration via Link Header

Renovate is a dependency update automation tool. In versions before 44.11.2 and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0, when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by...

CVE-2026-88881

Renovate versions before 44.11.3 are vulnerable to credential exfiltration when following pagination links in the HTTP Link header. The root cause is that the pagination URL returned by a GitHub server is not validated against the originally contacted host, allowing a malicious or compromised ser...

@cenk1cenk2/renovate-config (>=1.0.9, <=2.3.148), @jamietanna/patch-testing (>=0.1.0, <=0.2.28) +11 more potentially affected by CVE-2026-88881 via renovate (>=21.33.15, <=43.288.0)

renovate NPM version =21.33.15, =1.0.9, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.2.0, =1.0.0, =1.0.1, =0.0.1, =0.11.0, =1.4.3 Source cves: CVE-2026-88881 Source advisory: MEND:CVE-2026-88881...

2pg-oauth (>=1.0.0, <=1.0.1), 3dshex (>=0.1.0, <=0.5.3) +14699 more potentially affected by CVE-2026-88038 via cookies (>=0.1.2, <=0.9.1)

cookies NPM version =0.1.2, =1.0.0, =0.1.0, =0.2.0, =4.11.0, =0.1.4, =1.0.4, =1.0.3, =1.0.0, =1.0.2, =1.0.3, =1.0.3, =1.0.0, =1.0.2, =1.0.5 and more Source cves: CVE-2026-88038 Source advisory: MEND:CVE-2026-88038...

@rustybrooks/eslint-config-prettier (>=1.0.0, <=1.0.18) potentially affected by unknown CVE via eslint-plugin-airbnb-base (0.0.1-security)

eslint-plugin-airbnb-base NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on eslint-plugin-airbnb-base and may be impacted: - @rustybrooks/eslint-config-prettier =1.0.0, =1.0.18 Source cves: unknown CVE Source advisory:...

hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-88001 via open-webui (0.11.0)

open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-88001 Source advisory: OSV:PYSEC-2026-3878...

hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-88000 via open-webui (0.11.0)

open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-88000 Source advisory: OSV:PYSEC-2026-3877...