1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2124 more potentially affected by CVE-2026-41240 via dompurify (>=3.0.0, <=3.3.3)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =0.2.10 and more Source cves: CVE-2026-41240 Source advisory: SNYK:JS-DOMPURIFY-16078387...

SUSE SLED15 / SLES15 Security Update : rubygem-bundler (SUSE-SU-2026:1355-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1355-1 advisory. Updated to version 2.2.34. - CVE-2020-36327: Bundler chooses a dependency source based on the highest gem...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the pprof endpoint. An attacker can obtain sensitive authentication tokens by sending unauthenticated requests to the /debug/pprof/cmdline endpoint and subsequently use the leaked token to gain unauthorized...

@reldens/server-utils (0.48.0), @sap-ux/ui-components (>=2.1.4, <=2.1.10) +11 more potentially affected by CVE-2026-40186 via sanitize-html (2.17.2)

sanitize-html NPM version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @reldens/server-utils 0.48.0 - @sap-ux/ui-components =2.1.4, =0.6.17, =0.3.16, =0.1.32, =0.0.31, =0.30.19, =1.0.0-alpha.5, =0.19.3,...

CVE-2026-40261

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the...

CVE-2026-40261 Composer has Command Injection via Malicious Perforce Reference

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the...

CVE-2026-40261

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the...

Malicious code in kyleip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6a05611ec8862117c6403a4a06759ca56bf2922c2b142a4661b77fd214ef26be Package exploits dependency confusion. A beacon request is used to report usage back, but no additional information are exfiltrated. --- Category:...

MAL-2026-2698 Malicious code in kyleip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6a05611ec8862117c6403a4a06759ca56bf2922c2b142a4661b77fd214ef26be Package exploits dependency confusion. A beacon request is used to report usage back, but no additional information are exfiltrated. --- Category:...

@amedia/brick-mcp (>=0.0.0-vBRAND-20260313141110, <=1.0.3), @area15/ticket-component (0.1.0) +229 more potentially affected by CVE-2025-32442 +1 more via fastify (>=5.3.2, <=5.8.4)

fastify NPM version =5.3.2, =0.0.0-vBRAND-20260313141110, =2.0.1, =1.1.1, =0.6.2, =0.1.1, =0.1.1, =0.6.0, =0.1.1, =0.0.35, =0.0.82, =0.0.1, =0.0.6, =0.1.68, =0.1.0, =0.8.2 and more Source cves: CVE-2025-32442, CVE-2026-33806 Source advisory: OSV:GHSA-247C-9743-5963...

dev.dsf:dsf-fhir-server-jetty (>=1.0.0-m1, <=1.9.0), dev.dsf:dsf-tools-test-data-generator (>=1.0.0-m1, <=1.9.0) potentially affected by CVE-2026-40939 via dev.dsf:dsf-fhir-server (>=1.0.0, <=1.9.0)

dev.dsf:dsf-fhir-server MAVEN version =1.0.0, =1.0.0-m1, =1.0.0-m1, =1.9.0 Source cves: CVE-2026-40939 Source advisory: SNYK:JAVA-DEVDSF-16540567...

dev.dsf:dsf-bpe-server-jetty (>=1.0.0-m1, <=1.9.0) potentially affected by CVE-2026-40939 via dev.dsf:dsf-bpe-server (>=1.0.0, <=1.9.0)

dev.dsf:dsf-bpe-server MAVEN version =1.0.0, =1.0.0-m1, =1.9.0 Source cves: CVE-2026-40939 Source advisory: SNYK:JAVA-DEVDSF-16540564...

dev.dsf:dsf-bpe-process-api-v1 (>=1.0.0-m1, <=1.9.0), dev.dsf:dsf-bpe-server (>=1.0.0-m1, <=1.9.0) +10 more potentially affected by CVE-2026-40939 via dev.dsf:dsf-common-auth (>=1.0.0, <=1.9.0)

dev.dsf:dsf-common-auth MAVEN version =1.0.0, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.2.0 Source cves: CVE-2026-40939 Source advisory: SNYK:JAVA-DEVDSF-16540566...

dev.dsf:dsf-bpe-server-jetty (>=1.0.0-m1, <=1.9.0), dev.dsf:dsf-fhir-server-jetty (>=1.0.0-m1, <=1.9.0) potentially affected by CVE-2026-40939 via dev.dsf:dsf-common-jetty (>=1.0.0, <=1.9.0)

dev.dsf:dsf-common-jetty MAVEN version =1.0.0, =1.0.0-m1, =1.0.0-m1, =1.9.0 Source cves: CVE-2026-40939 Source advisory: SNYK:JAVA-DEVDSF-16540565...

@amitojsingh366/keepkey-hardware-controller (0.0.10), @apsiocoin/protobuf-serialization (0.0.1-alpha1) +176 more potentially affected by CVE-2026-5758 via protocol-buffers-schema (>=3.1.0, <=3.6.0)

protocol-buffers-schema NPM version =3.1.0, =2.0.9, =2.0.7, =2.1.2, =0.0.25, =0.0.19, =2.0.12, =2.0.11, =0.3.0, =0.0.12, =6.1.2, =0.18.4, =0.18.4, =1.16.11, =3.0.1 and more Source cves: CVE-2026-5758 Source advisory: OSV:GHSA-J452-XHG8-QG39...

@amitojsingh366/keepkey-hardware-controller (0.0.10), @apsiocoin/protobuf-serialization (0.0.1-alpha1) +176 more potentially affected by CVE-2026-5758 via protocol-buffers-schema (>=3.1.0, <=3.6.0)

protocol-buffers-schema NPM version =3.1.0, =2.0.9, =2.0.7, =2.1.2, =0.0.25, =0.0.19, =2.0.12, =2.0.11, =0.3.0, =0.0.12, =6.1.2, =0.18.4, =0.18.4, =1.16.11, =3.0.1 and more Source cves: CVE-2026-5758 Source advisory: SNYK:JS-PROTOCOLBUFFERSSCHEMA-16420259...

SUSE-SU-2026:1355-1 Security update for rubygem-bundler

This update for rubygem-bundler fixes the following issues: Updated to version 2.2.34. - CVE-2020-36327: Bundler chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen bsc1185842 - CVE-2021-43809: rubygem-bundler:...

Security update for rubygem-bundler

This update for rubygem-bundler fixes the following issues: Updated to version 2.2.34. CVE-2020-36327: Bundler chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen bsc1185842 CVE-2021-43809: rubygem-bundler: remot...

@cmmn/tools (>=3.0.0-alpha-1, <=3.0.0-alpha-6), mikr0 (0.1.10) potentially affected by CVE-2026-33807 via @fastify/express (>=4.0.1, <=4.0.2)

@fastify/express NPM version =4.0.1, =3.0.0-alpha-1, =3.0.0-alpha-6 - mikr0 0.1.10 Source cves: CVE-2026-33807 Source advisory: SNYK:JS-FASTIFYEXPRESS-16068280...

@cmmn/tools (>=3.0.0-alpha-1, <=3.0.0-alpha-6), mikr0 (0.1.10) potentially affected by CVE-2026-33808 via @fastify/express (>=4.0.1, <=4.0.2)

@fastify/express NPM version =4.0.1, =3.0.0-alpha-1, =3.0.0-alpha-6 - mikr0 0.1.10 Source cves: CVE-2026-33808 Source advisory: SNYK:JS-FASTIFYEXPRESS-16068303...