GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: trivy-operator, nerdctl, istio, zarf, k9s, flux-source-controller, kubernetes-dashboard, kaf, loki, external-dns, kine, helm, spire-server, containerd, kubernetes, minio, zot, prometheus, osv-scanner, vitess, gitea, argo-cd, telegraf, flux, prometheus-operator, aactl...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: terragrunt, kaf, witness, teleport, helm, zot, prometheus, gitea, grype, flux, prometheus-operator, aactl, cilium, chisel, trivy, kyverno, flux-image-automation-controller, argocd-image-updater, act, nerdctl, zarf, flux-source-controller, argo-events,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: terragrunt, kaf, witness, teleport, helm, zot, prometheus, gitea, grype, flux, prometheus-operator, aactl, cilium, chisel, trivy, kyverno, flux-image-automation-controller, argocd-image-updater, act, nerdctl, zarf, flux-source-controller, argo-events,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: terragrunt, kaf, witness, ksops, terraform-provider-tls, teleport, helm, crossplane-provider-aws-kinesis, crossplane-provider-aws-elasticache, tw, crossplane-provider-aws-s3, sealed-secrets, zot, prometheus, docker-machine-driver-linode,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: trivy-operator, nerdctl, istio, zarf, k9s, flux-source-controller, kubernetes-dashboard, kaf, loki, external-dns, kine, helm, spire-server, containerd, kubernetes, minio, docker-machine-driver-harvester, zot, prometheus, osv-scanner, vitess, gitea, argo-cd, telegraf,...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: eks-node-monitoring-agent, kube-arangodb-fips, kaniko, docker, consul-k8s, gatekeeper, neuvector, kubescape-operator, neuvector-fips, kubevela, tigera-operator-fips, headlamp, scorecard, cg, wolfictl, kargo, xeol-fips, skaffold-fips, kubescape-operator-fips,...

@abtnode/ux (>=1.16.40 <=1.17.13-beta-20260512-042419-7b556a38), @ada-lc/echarts-materials (>=0.0.1 <=0.0.2) +501 more potentially affected by unknown CVE via echarts-for-react (>=3.0.0-beta.2 <=3.0.6)

echarts-for-react NPM version =3.0.0-beta.2, =1.16.40, =0.0.1, =0.1.0, =0.0.2-7.1, =0.1.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.3.5-beta.937, =1.0.8-alpha, =3.34.0, =0.1.10, =1.0.5, =1.0.339 and more Source cves: unknown CVE Source advisory: SNYK:JS-ECHARTSFORREACT-16754865...

@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @agentlab/ldkg-ui-charts (>=0.1.4 <=0.1.7) +297 more potentially affected by unknown CVE via @antv/async-hook (=2.2.9)

@antv/async-hook NPM version =2.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/async-hook and may be impacted: - @action.sustainability/storybook-dashboard =0.1.1, =0.1.4, =1.1.15, =0.1.0, =1.0.17-beta.1, =0.0.1-beta.2, =0.1.0, =1.2.0-beta.0...

@aidps/canvas-flow (>=1.0.0 <=1.0.1), @antv/xflow (>=2.0.1 <=2.2.4) +116 more potentially affected by unknown CVE via @antv/x6-plugin-selection (>=2.0.0 <=2.2.2)

@antv/x6-plugin-selection NPM version =2.0.0, =1.0.0, =2.0.1, =0.0.1, =0.0.2, =1.0.0-beta.46, =0.0.4, =0.7.0, =0.0.3, =2.0.4, =0.0.27, =3.0.0, =4.0.0-600 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVX6PLUGINSELECTION-16754927...

ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +372 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model (>=2.0.0-M1 <=2.0.0-M5)

org.springframework.ai:spring-ai-model MAVEN version =2.0.0-M1, =0.1.0, =0.1.0, =1.21.9, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-GCQC...

@3onedata/alsatian (>=0.1.8-fix.3 <=0.1.8-fix.5), @abyedev/hono-dotenv (=1.0.0) +538 more potentially affected by CVE-2026-44455 via hono (>=0.5.10 <=4.12.15)

hono NPM version =0.5.10, =0.1.8-fix.3, =5.0.0, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.1.4, =2026.4.4, =1.0.2, =0.1.1, =0.0.1, =0.0.2-a, =0.1.22, =1.1.1, =1.3.0 and more Source cves: CVE-2026-44455 Source advisory: OSV:GHSA-69XW-7HCM-H432...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: falcosidekick, seaweedfs, juicefs, keda, dapr, gitness, src, grafana, teleport, kine, hydra, rke2-cloud-provider, step, kuma, pgtimetable, spire-server, cerbos, jitsucom-bulker, temporal, openfga, caddy, argo-workflows, amass, openbao, wal-g, envoy-gateway, spqr,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: scorecard, trivy-operator, act, goreleaser, zarf, tfsec, dagger, k9s, flux-source-controller, gomplate, kargo, terragrunt, witness, grafana, argo-events, pulumi, teleport, pulumi-language-yaml, pulumi-language-dotnet, cerbos, guac, zot, crossplane, argo-workflows,...

2adif (=0.1.0), 3robotics (=0.0.1) +1536 more potentially affected by CVE-2026-42304 via twisted (>=20.3.0 <=26.4.0)

twisted PYPI version =20.3.0, =0.0.12, =3.0.9, =3.0.0, =0.1.0, =23.12.0rc1, =0.10.0, =0.0.1, =0.4.0, =3.0.0, =0.1.4, =1.0.0, =1.0.2 and more Source cves: CVE-2026-42304 Source advisory: OSV:GHSA-GRGV-6HW6-V9G4...

arches (=8.0.0a1), avaintegration-metapackage (>=6.0.4.3 <=6.0.4.13) +38 more potentially affected by CVE-2026-35192 via django (>=6.0.0 <=6.0.4)

django PYPI version =6.0.0, =6.0.4.3, =2.0.0, =1.1.0, =0.1.0, =0.4.5 - django-ndr-core =0.70.2 - django-sb-simple-migrations =0.9.0 - django-tasks-aws =0.2.0b1 and more Source cves: CVE-2026-35192 Source advisory: OSV:PYSEC-2026-50...

com.github.niupengyu.schedule:ahead-schedule-distributed (>=1.2.6-RELEASE <=1.2.8-RELEASE), com.github.niupengyu:ahead-frame-socket (>=1.2.1-RELEASE <=1.2.3-RELEASE) +40 more potentially affected by CVE-2026-42779 via org.apache.mina:mina-core (>=2.1.0 <=2.1.11)

org.apache.mina:mina-core MAVEN version =2.1.0, =1.2.6-RELEASE, =1.2.1-RELEASE, =2.2.1, =2.2.1, =3.0.0, =1.0.0, =3.0.11, =3.6.7, =3.6.7, =3.6.7, =3.6.10 and more Source cves: CVE-2026-42779 Source advisory: OSV:GHSA-VF5J-865M-MQ7C...

africa.absa:inception-application (>=1.1.0 <=1.2.0), africa.absa:inception-test (>=1.1.0 <=1.2.0) +2768 more potentially affected by CVE-2026-22745 via org.springframework:spring-webflux (>=5.0.0.RELEASE <=5.3.4)

org.springframework:spring-webflux MAVEN version =5.0.0.RELEASE, =1.1.0, =1.1.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =0.0.1, =v0.3.12, =v0.3.10, =v0.3.12, =2.1.2.RELEASE, =4.1.36, =4.1.7, =4.7.1 - br.com.m4rc310:br-com-m4rc310-graphql =1.0.1 - br.com.m4rc310:br-com-m4rc310-libs =1.0.1 and more...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: harbor, seaweedfs, flux-source-controller, juicefs, dex, grafana, teleport, ratify, minio, zot, openbao, gitlab-runner, spqr, sftpgo-plugin-auth, rclone, gitea, external-secrets-operator, telegraf, trufflehog, frp, flux, cert-manager, rancher-webhook, xeol, terraform...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: falcosidekick, seaweedfs, juicefs, keda, dapr, gitness, src, grafana, teleport, kine, hydra, rke2-cloud-provider, step, kuma, pgtimetable, spire-server, cerbos, jitsucom-bulker, temporal, openfga, caddy, argo-workflows, amass, openbao, wal-g, envoy-gateway, spqr,...

GHSA-3XC5-WRHM-F963 vulnerabilities

Vulnerabilities for packages: gitaly, kaniko, apko, cerbos, terragrunt, trufflehog-fips, gitea-fips, gitlab-runner-fips, kubevela, gitaly-fips, crossplane-fips, goreleaser, scorecard, argo-workflows-fips, cg, wolfictl, gitsign, kargo, xeol-fips, skaffold-fips, gitlab-rails-ce, argo-cd,...