GHSA-44PJ-7W5J-6H8G vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-7RJP-WM4X-4X9C vulnerabilities

Vulnerabilities for packages: chromium...

Malicious Package

Overview btree-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

GO-2026-6355 vulnerabilities

Vulnerabilities for packages: melange, bento, gomplate, osv-scanner, zot, containerd, kubernetes-dashboard, sftpgo, fscrypt, cerbos, prometheus-operator, scorecard, trivy-operator, telegraf, cert-manager, guac, act, k3s, trivy, kubescape, grype, cilium, skaffold, spire-server, dagger, gitness,...

@appium/base-plugin (>=3.2.0, <=3.3.0), @appium/fake-plugin (>=4.2.0, <=4.3.0) +9 more potentially affected by CVE-2026-58191 via @appium/base-driver (>=10.3.0, <=10.6.0)

@appium/base-driver NPM version =10.3.0, =3.2.0, =4.2.0, =1.0.0, =3.0.10, =2.107.37, =2.107.37, =3.3.0, =0.1.0-beta.1, =0.79.0, =1.0.96, =1.0.115 Source cves: CVE-2026-58191 Source advisory: OSV:GHSA-3WGP-X9P5-C7CC...

MAL-2026-14892 Malicious code in 3layerdipstackqokw95 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 645ec019e6e3a7c3f46ec5537e4713ad47775817a68d0c30445ed103ca91a53b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +342 more potentially affected by CVE-2026-77415 via jsonata (>=1.0.10, <=1.8.7)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-77415 Source advisory: SNYK:JS-JSONATA-19233334...

GO-2026-6223 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-driver-fips, kubeflow-pipelines, kubeflow-pipelines-fips...

MAL-2026-14336 Malicious code in arrayref (crates.io)

arrayref 0.3.10 was published to crates.io from a maintainer account droundy that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compiles the declared...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +289 more potentially affected by unknown CVE via vm2 (>=3.0.0, <=3.11.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves: unknown CVE...

CVE-2026-18165

creationtimestamp| type| source ---|---|--- 2026-08-15 13:48:50+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mt4st6feps2i...

DEBIAN-CVE-2026-68463

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: use pmruntimeresumeandget in suspend Replace pmruntimegetsync with pmruntimeresumeandget to simplify error handling. pmruntimeresumeandget automatically drops the usage counter on failure, avoiding the need...

GO-2026-5287 vulnerabilities

Vulnerabilities for packages: traefik, traefik-fips...

GO-2026-5371 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, kyverno-notation-aws...

GO-2023-1840 vulnerabilities

Vulnerabilities for packages: policy-controller, kubeflow-katib, kind...

GO-2026-5676 vulnerabilities

Vulnerabilities for packages: q, rke2-runtime, k8sgateway, dkron, mediamtx, coredns, rke2-runtime-fips, jitsucom-bulker, traefik-fips, k8sgateway-fips, opentelemetry-operator, kubedock, kargo, kubernetes-dns-node-cache, prometheus-blackbox-exporter, kyverno-policy-reporter-ui,...

GO-2025-3660 vulnerabilities

Vulnerabilities for packages: witness, kyverno-notation-aws-fips, kyverno-fips, dapr, tfsec, policy-controller-fips, kyverno-notation-aws, spire-server, cosign-fips, kyverno, kots, dapr-fips, conftest-fips, trivy, cosign, conftest, policy-controller, spire-server-fips, trivy-fips...

GO-2025-4245 vulnerabilities

Vulnerabilities for packages: rke2-runtime, argo-workflows-fips, k8sgateway, verticadb-operator-fips, coredns, opentelemetry-collector-contrib-fips, splunk-otel-collector-fips, jaeger-fips, jaeger, nrdot-collector-k8s-fips, grafana-alloy, argo-rollouts, k8sgateway-fips,...

GO-2025-3830 vulnerabilities

Vulnerabilities for packages: syft-fips, zot, dagger, opentelemetry-collector-contrib-fips, splunk-otel-collector-fips, goreleaser, agentbeat-fips, docker-compose-fips, prometheus, cadvisor, openfga-fips, telegraf, kargo, trufflehog-fips, apko, opentelemetry-collector-fips, prometheus-fips,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: fulcio, tekton-chains, cloudflared, spire-server, cosign-fips, rekor, terragrunt, kots, fulcio-fips, bank-vaults-fips, argo-workflows, cosign, timestamp-authority-fips, sops, falcoctl-fips, dex, tkn, flux-source-controller, slsa-verifier, aactl, vexctl,...