ai.covia:covia-claude-code (>=0.9.3, <=0.9.10), ai.covia:covia-discord (>=0.9.4, <=0.9.10) +2029 more potentially affected by CVE-2026-104721 via ch.qos.logback:logback-classic (>=1.6.0, <=1.6.4)

ch.qos.logback:logback-classic MAVEN version =1.6.0, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.9, =0.9.6, =0.7.0, =0.9.3, =0.9.9, =0.7.0, =0.7.0, =2.5.0-rc-1, =2.5.0-rc-1, =2.7.1 - ai.tock:bot-test 26.9.0 - ai.tock:bot-test-base 26.9.0 and more Source cves: CVE-2026-104721 Source advisory:...

0lever-utils (>=0.1.0, <=0.1.6), agents-schema (>=0.0.8, <=0.0.11) +252 more potentially affected by CVE-2026-66858 via thrift (>=0.9.2, <=0.24.0)

thrift PYPI version =0.9.2, =0.1.0, =0.0.8, =0.1.0, =0.1.0, =0.0.1, =1.0.1, =0.1.0, =0.13.3, =0.6.6, =1.0.6, =2.7.0rc1, =0.1.0, =0.0.32, =0.1.9, =0.1.12 and more Source cves: CVE-2026-66858 Source advisory: SNYK:PYTHON-THRIFT-20417194...

ai.chatur:cortex-core (>=0.0.1, <=0.1.4), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +6583 more potentially affected by CVE-2026-61373 via org.apache.thrift:libthrift (>=0.6.1, <=0.24.0)

org.apache.thrift:libthrift MAVEN version =0.6.1, =0.0.1, =0.0.1, =0.0.1, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =chaining-0.0.46-dev, =chaining-0.0.46-de...

@0xd541ecb3/byte-babe (>=1.0.0, <=1.2.1), @514labs/aurora-mcp (>=0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, <=0.0.64) +789 more potentially affected by CVE-2026-96294 via thrift (>=0.9.2, <=0.24.0)

thrift NPM version =0.9.2, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.0-dev, =1.0.0, =0.9.0, =0.0.0-186649, =0.0.0-06d7fc, =0.3.0, =0.0.1, =0.2.0, =0.2.0, =0.2.4 and more Source cves: CVE-2026-96294 Source advisory: MEND:CVE-2026-96294...

io.github.bkoehm:apacheds-embedded (0.6), org.apache.camel.karaf:camel-ldif (>=4.14.5, <=4.18.4) +57 more potentially affected by CVE-2026-103877 via org.apache.directory.api:api-ldap-schema-data (>=2.1.0, <=2.1.8)

org.apache.directory.api:api-ldap-schema-data MAVEN version =2.1.0, =4.14.5, =3.26.0, =3.26.0, =4.14.0, =4.14.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.8 - org.apache.directory.server:apacheds-core 2.0.0.am27 - org.apache.directory.server:apacheds-core-annotations 2.0.0.am27 -...

be.personify.iam:personify-provisioning (>=1.3.1.release, <=1.5.8.release), be.personify.iam:personify-scim-server (>=1.2.6.release, <=2.1.2.release) +31 more potentially affected by CVE-2026-103880 via org.apache.directory.api:api-all (>=2.1.0, <=2.1.8)

org.apache.directory.api:api-all MAVEN version =2.1.0, =1.3.1.release, =1.2.6.release, =3.0.0, =1.0.9, =1.6.9, =1.2.5, =1.1.7, =0.8.2, =1.2.15, =1.0.10, =4.3.2, =4.1.16, =4.1.17, =4.1.17, =4.4.5 and more Source cves: CVE-2026-103880 Source advisory: MEND:CVE-2026-103880...

com.itextpdf:bouncy-castle-fips-adapter (>=9.6.0, <=9.8.0), com.pkixops:pkixops-crypto (1.5.2) +165 more potentially affected by CVE-2026-17508 via org.bouncycastle:bcpkix-fips (>=2.1.8, <=2.1.12)

org.bouncycastle:bcpkix-fips MAVEN version =2.1.8, =9.6.0, =2.5.2, =2.5.2, =3.6.5, =5.1.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =1.192.0, =2.56.0 and more Source cves: CVE-2026-17508 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20535447...

app.cash.bittycity:outie (0.0.1), app.cash.bittycity:outie-jooq-provider (0.0.1) +1290 more potentially affected by CVE-2026-18036 via org.bouncycastle:bcprov-jdk15to18 (>=1.73, <=1.85.2)

org.bouncycastle:bcprov-jdk15to18 MAVEN version =1.73, =0.0.2, =0.0.2.1, =0.1.0-m36, =0.1.0-m27, =1.0.1-rc14, =3.5.0.0, =3.5.5.3 - cn.lnkdoc.sdk:awesome-uia-alipay-sdk 3.0.0-rc1 - cn.lnkdoc.sdk:awesome-uia-alipay-sdk-solon-boot-2-starter 3.0.0-rc1 -...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-17508 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.85)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.85 and more Source cves: CVE-2026-17508 Source advisory: MEND:CVE-2026-17508...

com.github.fmjsjx:libnetty-example (>=3.7.2, <=3.8.0-rc1), com.github.manosbatsis.corbeans:corbeans-corda-webserver (>=0.26, <=0.30) +62 more potentially affected by CVE-2026-17508 via org.bouncycastle:bcpkix-lts8on (>=2.73.6, <=2.73.12)

org.bouncycastle:bcpkix-lts8on MAVEN version =2.73.6, =3.7.2, =0.26, =0.26, =0.26, =0.26, =0.0.9-snapshot, =4.1.1-patch-01, =0.0.9-snapshot, =4.12, =4.12, =7.0, =7.5 and more Source cves: CVE-2026-17508 Source advisory: MEND:CVE-2026-17508...

Beyond Predefined Sinks: Security-Aware Dependency Analysis for LLM Agents

Large language model LLM-based agents increasingly connect model-generated decisions to security-sensitive software capabilities such as command execution, filesystem access, network communication, browser control, and external tools. Existing analyses often use predefined sensitive operations as...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-checkpoint-git_3 (>=0.3.0, <=0.5.7) +1836 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.19.0-rc2, <=2.21.5)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.19.0-rc2, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.5.7 - ai.fastllm:runtime-roster3 0.5.7 - app.perawallet.xhdwalletapi:xhdwalletapi-shared 1.2.0 and more...

com.amazonaws:athena-aws-cmdb (>=2026.28.1, <=2026.40.1), com.amazonaws:athena-cloudwatch (>=2026.28.1, <=2026.40.1) +196 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.22.0, =2026.28.1, =2026.28.1, =2026.28.1, =2026.28.1, =2026.28.1, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.22.0, =2.22.0, =0.11.0, =0.132.0, =0.142.0 and more Source cves: CVE-2026-68495 Source advisory:...

@cotecna/stencil-components (>=3.3.1, <=4.0.0), @happyknuckles/angular-standalone-clean-code (0.0.2) +2 more potentially affected by CVE-2026-103922 via @capacitor/ios (>=7.0.1, <=7.4.4)

@capacitor/ios NPM version =7.0.1, =3.3.1, =0.0.24, =1.0.1, =1.8.0 Source cves: CVE-2026-103922 Source advisory: MEND:CVE-2026-103922...

@cotecna/stencil-components (>=3.0.0, <=3.2.1), @sumaris-net/ngx-components (18.5.0-alpha2) +2 more potentially affected by CVE-2026-103922 via @capacitor/android (>=6.0.0-nightly-20240307T150431.0, <=6.2.0)

@capacitor/android NPM version =6.0.0-nightly-20240307T150431.0, =3.0.0, =1.0.0, =1.0.0, =1.1.6 Source cves: CVE-2026-103922 Source advisory: MEND:CVE-2026-103922...

@cotecna/stencil-components (>=3.3.1, <=4.0.0), @happyknuckles/angular-standalone-clean-code (0.0.2) +3 more potentially affected by CVE-2026-103922 via @capacitor/android (>=7.0.1, <=7.4.4)

@capacitor/android NPM version =7.0.1, =3.3.1, =0.0.24, =1.0.1, =0.0.1, =0.0.2 Source cves: CVE-2026-103922 Source advisory: MEND:CVE-2026-103922...

a2 (>=0.1.0, <=0.6.1), aaa-ml-datasets-course (1.0.0) +574 more potentially affected by CVE-2026-102830 via jupyterlab (>=3.0.0, <=4.5.8)

jupyterlab PYPI version =3.0.0, =0.1.0, =0.1.0b0, =0.1.0b0, =0.1.0b0, =0.1.0, =0.5.5, =2.0.0, =0.1.1, =0.1.0, =3.0.0, =4.33.0, =5.0.0 - arcor2-calibration 0.8.0 and more Source cves: CVE-2026-102830 Source advisory: OSV:PYSEC-2026-4056...

aaa-ml-datasets-course (1.0.0), aerocm (0.1.0b0) +148 more potentially affected by CVE-2026-102904 via jupyterlab (>=4.0.0, <=4.5.8)

jupyterlab PYPI version =4.0.0, =0.5.5, =2.0.0, =4.33.0, =1.0.1, =0.1.0, =1.6.4b1, =0.0.1, =1.8.2, =0.0.1, =0.3.1, =0.1.0, =0.1.4 - cad-viewer-widget 3.0.2 and more Source cves: CVE-2026-102904 Source advisory: OSV:PYSEC-2026-4055...

iiiflow (>=0.1.0, <=1.3.2), mayan-edms (>=4.5.0, <=4.5.8) potentially affected by CVE-2026-102998 via pypdf (3.14.0)

pypdf PYPI version 3.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - iiiflow =0.1.0, =4.5.0, =4.5.8 Source cves: CVE-2026-102998 Source advisory: OSV:PYSEC-2026-4157...

krummstab (>=0.2.0, <=1.2.1) potentially affected by CVE-2026-102998 via pypdf (3.1.0)

pypdf PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - krummstab =0.2.0, =1.2.1 Source cves: CVE-2026-102998 Source advisory: OSV:PYSEC-2026-4157...