0.extends.wechat (>=1.0.51, <=1.0.65), 1-test-gulp-1 (>=0.0.1, <=0.0.4) +16102 more potentially affected by CVE-2026-31808 via file-type (>=13.0.3, <=21.3.0)

file-type NPM version =13.0.3, =1.0.51, =0.0.1, =2.2.0-alpha.0, =3.1.4, =1.0.0, =0.0.1, =1.0.0, =3.1.6, =1.0.0, =1.0.0, =0.0.1, =0.0.2, =0.6.4 and more Source cves: CVE-2026-31808 Source advisory: OSV:GHSA-5V7R-6R5C-R473...

0.extends.wechat (>=1.0.51, <=1.0.65), 1-test-gulp-1 (>=0.0.1, <=0.0.4) +16102 more potentially affected by CVE-2026-31808 via file-type (>=13.0.3, <=21.3.0)

file-type NPM version =13.0.3, =1.0.51, =0.0.1, =2.2.0-alpha.0, =3.1.4, =1.0.0, =0.0.1, =1.0.0, =3.1.6, =1.0.0, =1.0.0, =0.0.1, =0.0.2, =0.6.4 and more Source cves: CVE-2026-31808 Source advisory: SNYK:JS-FILETYPE-15456217...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @adenta/cms (>=0.0.6, <=1.1.1-0) +556 more potentially affected by CVE-2026-31802 via tar (>=7.0.0, <=7.5.10)

tar NPM version =7.0.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =0.1.1, =0.1.1, =2.17.11, =1.9.5, =1.0.2, =8.8.3, =8.11.4 - @altipla/directus-sdk-utils 0.7.2 - @applitools/core 4.20.0 - @applitools/core-base 1.17.0 - @applitools/ec-client 1.9.6 and more Source cves: CVE-2026-31802 Source...

org.webjars.npm:canvas (>=2.5.0, <=2.6.0), org.webjars.npm:color-thief (2.2.5) +12 more potentially affected by CVE-2026-31802 via org.webjars.npm:tar (>=0.1.20, <=4.4.19)

org.webjars.npm:tar MAVEN version =0.1.20, =2.5.0, =0.97.5, =0.2.0, =3.4.0, =0.6.19, =2.0.0, =3.1.4, =3.4.1 - org.webjars.npm:tar.gz 1.0.7 Source cves: CVE-2026-31802 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15456202...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @adenta/cms (>=0.0.6, <=1.1.1-0) +556 more potentially affected by CVE-2026-31802 via tar (>=7.0.0, <=7.5.10)

tar NPM version =7.0.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =0.1.1, =0.1.1, =2.17.11, =1.9.5, =1.0.2, =8.8.3, =8.11.4 - @altipla/directus-sdk-utils 0.7.2 - @applitools/core 4.20.0 - @applitools/core-base 1.17.0 - @applitools/ec-client 1.9.6 and more Source cves: CVE-2026-31802 Source...

@snickbit/feathers-logs (>=1.0.0-0, <=1.0.27), @snickbit/feathers-mongo (>=1.0.0-0, <=2.0.11) +6 more potentially affected by CVE-2026-29793 via @feathersjs/mongodb (>=5.0.0-pre.20, <=5.0.12)

@feathersjs/mongodb NPM version =5.0.0-pre.20, =1.0.0-0, =1.0.0-0, =1.0.0-0, =0.0.29, =0.0.29, =0.0.29, =2.0.4, =0.0.1, =2.0.4 Source cves: CVE-2026-29793 Source advisory: SNYK:JS-FEATHERSJSMONGODB-15456216...

@ind-rcg/generator (>=262.1002.0-beta.2, <=264.1004.0-beta.1), @ind-rcg/modeler-sfdx-cli-plugin (>=262.1002.0-beta.4, <=264.1004.0-beta.4) +2 more potentially affected by CVE-2026-26801 via pdfmake (>=0.3.0-beta.2, <=0.3.2)

pdfmake NPM version =0.3.0-beta.2, =262.1002.0-beta.2, =262.1002.0-beta.4, =262.1002.0-beta.3, =1.0.0, =2.3.0 Source cves: CVE-2026-26801 Source advisory: OSV:GHSA-WP52-R2FP-4VMR...

@agentic-ui-experience/ui-arcgis (>=0.0.1-beta.1, <=0.0.1-beta.4), @amcharts/amcharts5 (>=5.18.0, <=5.20.2) +124 more potentially affected by CVE-2026-26801 via pdfmake (>=0.3.0-beta.2, <=0.3.11)

pdfmake NPM version =0.3.0-beta.2, =0.0.1-beta.1, =5.18.0, =0.0.1, =4.32.0-next.84, =4.32.0-next.84, =4.32.0-next.84, =5.1.0-next.124, =4.34.0-next.52, =4.34.0-next.29, =4.34.0-next.29, =0.2.0, =0.0.1, =1.0.57, =1.3.1 - @bugenzi/formpdf-editor 0.1.0 and more Source cves: CVE-2026-26801 Source...

@228-fund/elysia-effect (0.0.1), @228-fund/elysia-msgpack (>=0.0.1, <=0.0.3) +66 more potentially affected by CVE-2026-30837 via elysia (>=1.0.9, <=1.4.22)

elysia NPM version =1.0.9, =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.4, =0.1.0, =0.1.0-next.4, =1.0.0-next.4, =1.0.0, =0.0.1, =1.0.3, =1.0.10 and more Source cves: CVE-2026-30837 Source advisory: OSV:GHSA-F45G-68Q3-5W8X...

@228-fund/elysia-effect (0.0.1), @228-fund/elysia-msgpack (>=0.0.1, <=0.0.3) +66 more potentially affected by CVE-2026-30837 via elysia (>=1.0.9, <=1.4.22)

elysia NPM version =1.0.9, =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.4, =0.1.0, =0.1.0-next.4, =1.0.0-next.4, =1.0.0, =0.0.1, =1.0.3, =1.0.10 and more Source cves: CVE-2026-30837 Source advisory: SNYK:JS-ELYSIA-15469934...

@snickbit/feathers-logs (>=1.0.0-0, <=1.0.27), @snickbit/feathers-mongo (>=1.0.0-0, <=2.0.11) +6 more potentially affected by CVE-2026-29793 via @feathersjs/mongodb (>=5.0.0-pre.20, <=5.0.12)

@feathersjs/mongodb NPM version =5.0.0-pre.20, =1.0.0-0, =1.0.0-0, =1.0.0-0, =0.0.29, =0.0.29, =0.0.29, =2.0.4, =0.0.1, =2.0.4 Source cves: CVE-2026-29793 Source advisory: OSV:GHSA-P9XR-7P9P-GPQX...

@ir-engine/server-core (1.6.0), @ir-engine/taskserver (1.6.0) +4 more potentially affected by CVE-2026-29792 via @feathersjs/authentication-oauth (>=5.0.0-pre.10, <=5.0.12)

@feathersjs/authentication-oauth NPM version =5.0.0-pre.10, =2.0.4, =0.5.0, =0.5.4, =0.0.1, =2.0.4 Source cves: CVE-2026-29792 Source advisory: SNYK:JS-FEATHERSJSAUTHENTICATIONOAUTH-15470092...

@ir-engine/server-core (1.6.0), @ir-engine/taskserver (1.6.0) +4 more potentially affected by CVE-2026-29792 via @feathersjs/authentication-oauth (>=5.0.0-pre.10, <=5.0.12)

@feathersjs/authentication-oauth NPM version =5.0.0-pre.10, =2.0.4, =0.5.0, =0.5.4, =0.0.1, =2.0.4 Source cves: CVE-2026-29792 Source advisory: OSV:GHSA-WG9X-QFGW-PXHJ...

GHSA-7R34-79R5-RCC9 MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers

Summary An unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL by supplying two custom HTTP headers without an Authorization header. No authentication is required. The...

CVE-2026-27826

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to version 0.17.0, an unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL b...

EUVD-2026-10789

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to version 0.17.0, an unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL b...

org.webjars.npm:g-status (2.0.2), org.webjars.npm:graphql-toolkit__git-loader (0.7.5) potentially affected by CVE-2022-25912 +1 more via org.webjars.npm:simple-git (>=1.129.0, <=1.132.0)

org.webjars.npm:simple-git MAVEN version =1.129.0, =1.132.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:simple-git and may be impacted: - org.webjars.npm:g-status 2.0.2 - org.webjars.npm:graphql-toolkitgit-loader 0.7.5 Source cves:...

3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +481 more potentially affected by CVE-2022-25912 +1 more via simple-git (>=3.15.0, <=3.32.2)

simple-git NPM version =3.15.0, =1.0.1, =1.0.1, =0.0.0-aj-beta.7, =23.0.0, =35.0.0, =1.4.0, =0.1.5-alpha.0, =1.0.2, =8.7.2, =39.0.2, =0.0.1, =0.0.8 and more Source cves: CVE-2022-25912, CVE-2026-28292 Source advisory: SNYK:JS-SIMPLEGIT-15457646...

3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +481 more potentially affected by CVE-2026-28292 via simple-git (>=3.15.0, <=3.32.2)

simple-git NPM version =3.15.0, =1.0.1, =1.0.1, =0.0.0-aj-beta.7, =23.0.0, =35.0.0, =1.4.0, =0.1.5-alpha.0, =1.0.2, =8.7.2, =39.0.2, =0.0.1, =0.0.8 and more Source cves: CVE-2026-28292 Source advisory: OSV:GHSA-R275-FR43-PM7Q...

EUVD-2026-10578

Dependency on vulnerable third-party component in GitHub Repo: zero-shot-scfoundation allows an unauthorized attacker to execute code over a network...