assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-46673 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-46673 Source advisory: OSV:RUSTSEC-2026-0154...

APM – Agent Package Manager 路径遍历漏洞

APM – Agent Package Manager is an open-source AI-based dependency management tool developed by Microsoft. Versions of APM prior to 0.8.12 contained a path traversal vulnerability. This vulnerability stemmed from the lack of verification that the plugin paths were within the plugin directory, whic...

Security update for go1.26

This update for go1.26 fixes the following issues Security issues: CVE-2026-33811: net: crash when handling long CNAME response bsc1264508. CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1264506. CVE-2026-39817: cmd/go: "go tool pack" does not...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the process that generates uninstall scripts from uploaded software packages, due to improper sanitization of metadata fields. An attacker can execute arbitrary commands with elevated privileges on managed endpoints...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +287 more potentially affected by CVE-2026-45411 via vm2 (>=3.0.0, <=3.11.2)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@3deye-toolkit/core (>=0.0.1-alpha.7, <=0.0.10), @3deye-toolkit/react-camera (>=0.0.1-alpha.7, <=0.0.10) +88 more potentially affected by CVE-2026-46509 via @ranfdev/deepobj (1.0.2)

@ranfdev/deepobj NPM version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @ranfdev/deepobj and may be impacted: - @3deye-toolkit/core =0.0.1-alpha.7, =0.0.1-alpha.7, =0.0.1-alpha.7, =0.0.1-alpha.12, =0.0.1, =0.0.1, =0.0.3, =0.0.6-beta.0,...

@burger-editor/client (>=4.0.0-alpha.43, <=4.0.0-alpha.70), @children-of-atom/reactive-api (0.3.0) +24 more potentially affected by unknown CVE via svelte (>=5.46.0, <=5.55.5)

svelte NPM version =5.46.0, =4.0.0-alpha.43, =0.0.14, =8.1.10, =6.0.7, =0.1.0, =2.5.0, =6.4.1, =6.4.1, =4.0.0-alpha.4, =5.0.0-rc.0, =5.0.0-rc.0, =4.7.13, =1.25.19, =1.0.0-dev.35, =1.0.0-dev.54 and more Source cves: unknown CVE Source advisory: OSV:GHSA-F3CJ-J4F6-WQ85...

@burger-editor/client (>=4.0.0-alpha.43, <=4.0.0-alpha.70), @children-of-atom/reactive-api (0.3.0) +24 more potentially affected by unknown CVE via svelte (>=5.46.0, <=5.55.5)

svelte NPM version =5.46.0, =4.0.0-alpha.43, =0.0.14, =8.1.10, =6.0.7, =0.1.0, =2.5.0, =6.4.1, =6.4.1, =4.0.0-alpha.4, =5.0.0-rc.0, =5.0.0-rc.0, =4.7.13, =1.25.19, =1.0.0-dev.35, =1.0.0-dev.54 and more Source cves: unknown CVE Source advisory: SNYK:JS-SVELTE-16697573...

@budibase/server (>=3.32.1, <=3.38.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.6.6, <=2.1.0) +64 more potentially affected by CVE-2026-42573 via svelte (>=5.0.0, <=5.55.5)

svelte NPM version =5.0.0, =3.32.1, =0.6.6, =4.0.0-alpha.1, =4.0.0-alpha.1, =0.1.0, =0.0.1, =1.3.0, =0.1.4, =0.0.20, =0.15.0-beta.2, =1.1.0-beta.0, =5.0.0-next.80, =5.0.0-test.1 and more Source cves: CVE-2026-42573 Source advisory: SNYK:JS-SVELTE-16697541...

@budibase/server (>=3.32.1, <=3.38.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.6.6, <=2.1.0) +64 more potentially affected by CVE-2026-42573 via svelte (>=5.0.0, <=5.55.5)

svelte NPM version =5.0.0, =3.32.1, =0.6.6, =4.0.0-alpha.1, =4.0.0-alpha.1, =0.1.0, =0.0.1, =1.3.0, =0.1.4, =0.0.20, =0.15.0-beta.2, =1.1.0-beta.0, =5.0.0-next.80, =5.0.0-test.1 and more Source cves: CVE-2026-42573 Source advisory: OSV:GHSA-RCQX-6Q8C-2C42...

org.webjars.npm:event-calendar__core (>=3.1.0, <=3.7.1), org.webjars.npm:event-calendar__day-grid (3.6.2) +2 more potentially affected by CVE-2026-42573 via org.webjars.npm:svelte (>=3.20.1, <=4.2.19)

org.webjars.npm:svelte MAVEN version =3.20.1, =3.1.0, =3.1.0, =3.6.2 - org.webjars.npm:stylesheet-switcher 3.0.0 Source cves: CVE-2026-42573 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16697542...

org.webjars.npm:event-calendar__core (>=3.1.0, <=3.7.1), org.webjars.npm:event-calendar__day-grid (3.6.2) +2 more potentially affected by CVE-2026-42567 via org.webjars.npm:svelte (>=3.20.1, <=4.2.19)

org.webjars.npm:svelte MAVEN version =3.20.1, =3.1.0, =3.1.0, =3.6.2 - org.webjars.npm:stylesheet-switcher 3.0.0 Source cves: CVE-2026-42567 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16697649...

@burger-editor/client (>=4.0.0-alpha.62, <=4.0.0-alpha.70), @children-of-atom/reactive-api (0.3.0) +24 more potentially affected by CVE-2026-42567 via svelte (>=5.51.5, <=5.55.5)

svelte NPM version =5.51.5, =4.0.0-alpha.62, =0.0.15, =8.1.10, =6.1.0, =0.1.0, =2.6.0, =6.4.1, =6.4.1, =4.0.0-alpha.4, =5.0.0-rc.0, =5.0.0-rc.0, =4.18.0, =1.26.10, =1.0.0-dev.35, =1.0.0-dev.54 and more Source cves: CVE-2026-42567 Source advisory: OSV:GHSA-9RMH-MM8F-R9H6...

@burger-editor/client (>=4.0.0-alpha.62, <=4.0.0-alpha.70), @children-of-atom/reactive-api (0.3.0) +24 more potentially affected by CVE-2026-42567 via svelte (>=5.51.5, <=5.55.5)

svelte NPM version =5.51.5, =4.0.0-alpha.62, =0.0.15, =8.1.10, =6.1.0, =0.1.0, =2.6.0, =6.4.1, =6.4.1, =4.0.0-alpha.4, =5.0.0-rc.0, =5.0.0-rc.0, =4.18.0, =1.26.10, =1.0.0-dev.35, =1.0.0-dev.54 and more Source cves: CVE-2026-42567 Source advisory: SNYK:JS-SVELTE-16697648...

@ekairos/cli (>=1.22.35, <=1.22.106-beta.feature-context-event-reaction-architecture.0), @ekairos/context (>=1.22.102-beta.feature-lab-task-sandbox-beta.0, <=1.22.106-beta.feature-context-event-reaction-architecture.0) +31 more potentially affected by CVE-2026-42570 via devalue (5.6.3)

devalue NPM version 5.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on devalue and may be impacted: - @ekairos/cli =1.22.35, =1.22.102-beta.feature-lab-task-sandbox-beta.0, =1.21.52-beta.0, =1.22.9-beta.development.0, =1.22.13-beta.development.0,...

@ekairos/cli (>=1.22.35, <=1.22.106-beta.feature-context-event-reaction-architecture.0), @ekairos/context (>=1.22.102-beta.feature-lab-task-sandbox-beta.0, <=1.22.106-beta.feature-context-event-reaction-architecture.0) +31 more potentially affected by CVE-2026-42570 via devalue (5.6.3)

devalue NPM version 5.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on devalue and may be impacted: - @ekairos/cli =1.22.35, =1.22.102-beta.feature-lab-task-sandbox-beta.0, =1.21.52-beta.0, =1.22.9-beta.development.0, =1.22.13-beta.development.0,...

org.webjars.npm:svelte (5.53.12) potentially affected by CVE-2026-42570 via org.webjars.npm:devalue (5.6.4)

org.webjars.npm:devalue MAVEN version 5.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:devalue and may be impacted: - org.webjars.npm:svelte 5.53.12 Source cves: CVE-2026-42570 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16697434...

org.webjars.npm:event-calendar__core (>=3.1.0, <=3.7.1), org.webjars.npm:event-calendar__day-grid (3.6.2) +2 more potentially affected by CVE-2026-42599 via org.webjars.npm:svelte (>=3.20.1, <=4.2.19)

org.webjars.npm:svelte MAVEN version =3.20.1, =3.1.0, =3.1.0, =3.6.2 - org.webjars.npm:stylesheet-switcher 3.0.0 Source cves: CVE-2026-42599 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16697616...

@budibase/server (>=3.32.1, <=3.38.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.6.6, <=2.1.0) +64 more potentially affected by CVE-2026-42599 via svelte (>=5.0.0, <=5.55.5)

svelte NPM version =5.0.0, =3.32.1, =0.6.6, =4.0.0-alpha.1, =4.0.0-alpha.1, =0.1.0, =0.0.1, =1.3.0, =0.1.4, =0.0.20, =0.15.0-beta.2, =1.1.0-beta.0, =5.0.0-next.80, =5.0.0-test.1 and more Source cves: CVE-2026-42599 Source advisory: SNYK:JS-SVELTE-16697614...

@budibase/server (>=3.32.1, <=3.38.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.6.6, <=2.1.0) +64 more potentially affected by CVE-2026-42599 via svelte (>=5.0.0, <=5.55.5)

svelte NPM version =5.0.0, =3.32.1, =0.6.6, =4.0.0-alpha.1, =4.0.0-alpha.1, =0.1.0, =0.0.1, =1.3.0, =0.1.4, =0.0.20, =0.15.0-beta.2, =1.1.0-beta.0, =5.0.0-next.80, =5.0.0-test.1 and more Source cves: CVE-2026-42599 Source advisory: OSV:GHSA-PR6F-5X2Q-RWFP...