GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: containerd, nerdctl, istio, skaffold, k3s, trivy, telegraf, flux-source-controller, minio, vitess, chisel, mattermost, spire-server, kubernetes-dashboard, zot, kubescape, kaf, argo-cd, cilium, cloud-provider-aws, prometheus-operator, loki, aactl, kine, osv-scanner,...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: telegraf, pulumi-language-yaml, pulumi, vitess, spire-server, cilium, cloud-provider-aws, prometheus, kine, kots, gitlab-runner, guac, kubernetes, docker-machine-driver-harvester, flux-image-automation-controller, pulumi-kubernetes-operator, cert-manager,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: containerd, nerdctl, istio, skaffold, k3s, trivy, telegraf, flux-source-controller, minio, vitess, chisel, mattermost, spire-server, kubernetes-dashboard, zot, kubescape, kaf, argo-cd, cilium, cloud-provider-aws, prometheus-operator, loki, aactl, kine, osv-scanner,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: telegraf, pulumi-language-yaml, pulumi, vitess, spire-server, cilium, cloud-provider-aws, prometheus, kine, kots, gitlab-runner, guac, kubernetes, docker-machine-driver-harvester, flux-image-automation-controller, pulumi-kubernetes-operator, cert-manager,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-sql, crossplane-provider-aws-sqs, telegraf, crossplane-provider-azure-authorization, pulumi-language-yaml, pulumi, vitess, terraform-provider-acme, crossplane-provider-aws-kms, spire-server, fulcio, neuvector-sigstore-interface, caddy,...

0utmailauth (=1.0.0), 0xkobold (>=0.0.1 <=0.8.0) +25979 more potentially affected by CVE-2026-11525 via undici (>=0.3.3 <=6.26.0)

undici NPM version =0.3.3, =0.0.1, =0.2.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.1, =1.0.4 - 5.17task =1.0.0 - 5.18task =1.0.0 and more Source cves: CVE-2026-11525 Source advisory: OSV:GHSA-G8M3-5G58-FQ7M...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: upwind-agent, kube-mgmt, tigera-operator-fips, k8sgpt, cloudbeat-fips, helm-exporter, zot, trivy-operator-fips, tw, spegel, k8ssandra-client, chartmuseum, kaniko-fips, containerd-fips, skaffold, cloudbeat, grype-fips, kubescape-operator-fips, rancher-agent,...

@abtnode/ux (>=1.16.40 <=1.17.13-beta-20260512-042419-7b556a38), @ada-lc/echarts-materials (>=0.0.1 <=0.0.2) +501 more potentially affected by unknown CVE via echarts-for-react (>=3.0.0-beta.2 <=3.0.6)

echarts-for-react NPM version =3.0.0-beta.2, =1.16.40, =0.0.1, =0.1.0, =0.0.2-7.1, =0.1.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.3.5-beta.937, =1.0.8-alpha, =3.34.0, =0.1.10, =1.0.5, =1.0.339 and more Source cves: unknown CVE Source advisory: SNYK:JS-ECHARTSFORREACT-16754865...

@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @agentlab/ldkg-ui-charts (>=0.1.4 <=0.1.7) +297 more potentially affected by unknown CVE via @antv/async-hook (=2.2.9)

@antv/async-hook NPM version =2.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/async-hook and may be impacted: - @action.sustainability/storybook-dashboard =0.1.1, =0.1.4, =1.1.15, =0.1.0, =1.0.17-beta.1, =0.0.1-beta.2, =0.1.0, =1.2.0-beta.0...

@aidps/canvas-flow (>=1.0.0 <=1.0.1), @antv/xflow (>=2.0.1 <=2.2.4) +116 more potentially affected by unknown CVE via @antv/x6-plugin-selection (>=2.0.0 <=2.2.2)

@antv/x6-plugin-selection NPM version =2.0.0, =1.0.0, =2.0.1, =0.0.1, =0.0.2, =1.0.0-beta.46, =0.0.4, =0.7.0, =0.0.3, =2.0.4, =0.0.27, =3.0.0, =4.0.0-600 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVX6PLUGINSELECTION-16754927...

ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +372 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model (>=2.0.0-M1 <=2.0.0-M5)

org.springframework.ai:spring-ai-model MAVEN version =2.0.0-M1, =0.1.0, =0.1.0, =1.21.9, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-GCQC...

@3onedata/alsatian (>=0.1.8-fix.3 <=0.1.8-fix.5), @abyedev/hono-dotenv (=1.0.0) +538 more potentially affected by CVE-2026-44455 via hono (>=0.5.10 <=4.12.15)

hono NPM version =0.5.10, =0.1.8-fix.3, =5.0.0, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.1.4, =2026.4.4, =1.0.2, =0.1.1, =0.0.1, =0.0.2-a, =0.1.22, =1.1.1, =1.3.0 and more Source cves: CVE-2026-44455 Source advisory: OSV:GHSA-69XW-7HCM-H432...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: amass, hydra, grafana, sftpgo-plugin-eventstore, step-issuer, seaweedfs, k3s, spqr, steampipe, azure-service-operator, telegraf, jitsucom-bulker, opentelemetry-collector-contrib, dapr, certificate-transparency, cloudprober, wal-g, timescaledb-parallel-copy, gitness,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: grafana, crossplane, wolfictl, skaffold, syft, steampipe, trivy, rancher-fleet, pulumi-language-yaml, pulumi, nuclei, melange, flux-source-controller, gomplate, argo-workflows, pulumi-language-java, act, gitaly, trufflehog, zot, kubescape, argo-cd, gptscript, apko,...

2adif (=0.1.0), 3robotics (=0.0.1) +1536 more potentially affected by CVE-2026-42304 via twisted (>=20.3.0 <=26.4.0)

twisted PYPI version =20.3.0, =0.0.12, =3.0.9, =3.0.0, =0.1.0, =23.12.0rc1, =0.10.0, =0.0.1, =0.4.0, =3.0.0, =0.1.4, =1.0.0, =1.0.2 and more Source cves: CVE-2026-42304 Source advisory: OSV:GHSA-GRGV-6HW6-V9G4...

arches (=8.0.0a1), avaintegration-metapackage (>=6.0.4.3 <=6.0.4.13) +38 more potentially affected by CVE-2026-35192 via django (>=6.0.0 <=6.0.4)

django PYPI version =6.0.0, =6.0.4.3, =2.0.0, =1.1.0, =0.1.0, =0.4.5 - django-ndr-core =0.70.2 - django-sb-simple-migrations =0.9.0 - django-tasks-aws =0.2.0b1 and more Source cves: CVE-2026-35192 Source advisory: OSV:PYSEC-2026-50...

com.github.niupengyu.schedule:ahead-schedule-distributed (>=1.2.6-RELEASE <=1.2.8-RELEASE), com.github.niupengyu:ahead-frame-socket (>=1.2.1-RELEASE <=1.2.3-RELEASE) +40 more potentially affected by CVE-2026-42779 via org.apache.mina:mina-core (>=2.1.0 <=2.1.11)

org.apache.mina:mina-core MAVEN version =2.1.0, =1.2.6-RELEASE, =1.2.1-RELEASE, =2.2.1, =2.2.1, =3.0.0, =1.0.0, =3.0.11, =3.6.7, =3.6.7, =3.6.7, =3.6.10 and more Source cves: CVE-2026-42779 Source advisory: OSV:GHSA-VF5J-865M-MQ7C...

africa.absa:inception-application (>=1.1.0 <=1.2.0), africa.absa:inception-test (>=1.1.0 <=1.2.0) +2768 more potentially affected by CVE-2026-22745 via org.springframework:spring-webflux (>=5.0.0.RELEASE <=5.3.4)

org.springframework:spring-webflux MAVEN version =5.0.0.RELEASE, =1.1.0, =1.1.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =0.0.1, =v0.3.12, =v0.3.10, =v0.3.12, =2.1.2.RELEASE, =4.1.36, =4.1.7, =4.7.1 - br.com.m4rc310:br-com-m4rc310-graphql =1.0.1 - br.com.m4rc310:br-com-m4rc310-libs =1.0.1 and more...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: grafana, k6, seaweedfs, dex, spqr, telegraf, ratify, nuclei, minio, flux-source-controller, terraform, cert-manager-cmctl, trufflehog, zot, bento, harbor, cert-manager-istio-csr, kyverno-notation-aws, gitlab-runner, opentofu, cert-manager-csi-driver, cert-manager,...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: amass, hydra, grafana, sftpgo-plugin-eventstore, step-issuer, seaweedfs, k3s, spqr, steampipe, azure-service-operator, telegraf, jitsucom-bulker, opentelemetry-collector-contrib, dapr, certificate-transparency, cloudprober, wal-g, timescaledb-parallel-copy, gitness,...