@a-rt-works/auth0-deploy-cli (3.3.3), @acknow-srl/express-openid (>=1.0.0, <=1.0.1) +540 more potentially affected by CVE-2026-42264 +1 more via axios (>=0.31.1, <=0.32.0)

axios NPM version =0.31.1, =1.0.0, =0.0.1, =0.0.2, =1.3.2, =0.2.0, =0.0.2-beta.0, =2.0.14, =0.5.12, =1.0.0, =1.0.1, =32.0.0, =0.2.4, =0.3.0 and more Source cves: CVE-2026-42264, CVE-2026-67320 Source advisory: SNYK:JS-AXIOS-18065351...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @20206205tech/nestjs-common (>=0.8.0, <=0.11.3) +1136 more potentially affected by CVE-2026-59877 via protobufjs (>=8.0.0, <=8.6.5)

protobufjs NPM version =8.0.0, =1.1.0-beta.8, =0.8.0, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.8.0 and more Source cves: CVE-2026-59877 Source advisory: OSV:GHSA-J3F2-48V5-CCWW...

Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

Summary Type: Algorithmic-complexity denial of service. A run of N closed pairs xx... or the analogous ==x== for mark, ^^x^^ for insert causes ON² work in the formatting parser. With the strikethrough, mark, or insert plugin enabled, an 8 KB input pegs the CPU for 4 seconds; 16 KB → 17 seconds...

NPM: js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

NPM: js-yaml: Quadratic-complexity On^2 DoS via !!omap tag in YAML11SCHEMA vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.2.0...

@activepieces/piece-google-gemini (0.1.6), @activepieces/piece-google-vertexai (0.1.2) +8 more potentially affected by CVE-2026-13149 via brace-expansion (>=2.0.0, <=2.0.2)

brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-13149 Source advisory: OSV:GHSA-3JXR-9VMJ-R5CP...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +28 more potentially affected by CVE-2026-13149 via brace-expansion (>=1.1.0, <=1.1.13)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.3, =0.1.0 and more Source cves: CVE-2026-13149 Source advisory: OSV:GHSA-3JXR-9VMJ-R5CP...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process termination...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +19071 more potentially affected by CVE-2026-67313 via axios (>=1.0.0, <=1.17.0)

axios NPM version =1.0.0, =0.0.8, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =1.0.53, =0.1.0, =1.0.1, =1.0.0, =0.1.0, =0.0.1, =0.0.1, =0.1.2, =1.1.0, =2.0.0 and more Source cves: CVE-2026-67313 Source advisory: SNYK:JS-AXIOS-18060167...

CVE-2026-47275

Nanomq has a NULL pointer dereference in nni_mqttv5_msg_decode_connect() (mqtt_codec.c:1863) for versions ≤ 0.24.11. The code iterates CONNECT properties using prop instead of will_prop; when a packet has no connect-level properties but has will properties, dereferencing prop-&gt;next can SIGSEGV...

Important: Red Hat Security Advisory: python3.14 security update

An update for python3.14 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Security update for 389-ds

This update for 389-ds fixes the following issues: Update to version 2.2.10git255.752643c78. Security issues fixed: CVE-2026-11610: missing bounds check in sasliorecv can lead to a heap buffer overflow when processing a specially crafted oversized LDAP UNBIND packet bsc1270695. CVE-2026-11611:...

CVE-2026-64620 FreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_common

FreeRDP before 3.28.0 affected outlength, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an...

CVE-2026-64620 FreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_common

FreeRDP before 3.28.0 affected outlength, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an...

CVE-2026-63734

SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other...

media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si

...

KEYS: fix overflow in keyctl_pkey_params_get_2()

...

batman-adv: tp_meter: restrict number of unacked list entries

...

Amazon Linux 2023 : clamav1.4, clamav1.4-data, clamav1.4-devel (ALAS2023-2026-1956)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1956 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-1961)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1961 advisory. PHP: Failure to setup TLS with a remote server can result in a remote DoS CVE-2026-12184 PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD...

RockyLinux 8 : nodejs:22 (RLSA-2026:41947)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41947 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...