GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: external-dns, osv-scanner, cilium, prometheus-fips, kubescape, frankenphp-8.5, kine, kube-arangodb-fips, zitadel, kuma, traefik-fips, frankenphp-8.4, tigera-operator, gitlab-kas, mattermost-fips, frankenphp-8.2, terraform, trivy-operator-fips, chisel-fips, k3s, loki,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: istio, flux-source-controller, kaf, loki, minio, flux-image-automation-controller, kine, argocd-image-updater, kubernetes-dashboard, osv-scanner, kubescape, cilium, k9s, cloud-provider-aws, spire-server, trivy-operator, vitess, argo-cd, external-dns, kots, telegraf,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: pulumi, osv-scanner, cilium, cloud-provider-aws, buildah, telegraf, cluster-api-azure-controller, gitlab-runner, gh, external-secrets-operator, wolfictl, helm, flux-kustomize-controller, pulumi-kubernetes-operator, scorecard, syft, terragrunt, guac, aactl, eksctl,...

ai.spice:spiceai (=0.6.0), cn.isqing.icloud:icloud-common-utils (>=4.0.3-M1 <=4.0.3.1) +417 more potentially affected by CVE-2026-46340 via io.netty:netty-transport-sctp (>=4.2.0.Final <=4.2.14.Final)

io.netty:netty-transport-sctp MAVEN version =4.2.0.Final, =4.0.3-M1, =1.21.9, =3.4.7, =25.4.1, =26.2.1, =7.9.0, =5.1.0, =5.1.0, =6.80, =0.2.2, =0.2.4 and more Source cves: CVE-2026-46340 Source advisory: OSV:GHSA-5XRH-QMMQ-W6CH...

ai.spice:spiceai (=0.6.0), cn.isqing.icloud:icloud-common-utils (>=4.0.3-M1 <=4.0.3.1) +619 more potentially affected by CVE-2026-44893 via io.netty:netty-codec-haproxy (>=4.2.0.Final <=4.2.14.Final)

io.netty:netty-codec-haproxy MAVEN version =4.2.0.Final, =4.0.3-M1, =1.21.9, =3.4.7, =25.4.1, =26.2.1, =7.9.0, =5.1.0, =5.1.0, =6.80, =6.84 and more Source cves: CVE-2026-44893 Source advisory: OSV:GHSA-CC37-9Q2J-3HFV...

@agent-native/core (>=0.26.5 <=0.28.5), @intlayer/backend (=8.7.0-canary.0) +6 more potentially affected by CVE-2026-45337 via better-auth (>=1.6.0 <=1.6.10)

better-auth NPM version =1.6.0, =0.26.5, =0.0.33, =0.2.0, =1.6.0, =0.1.2, =0.2.0 Source cves: CVE-2026-45337 Source advisory: OSV:GHSA-CQ3F-VC6P-68FH...

0xpay-cc-sdk (>=0.0.8 <=0.1.0), 0xtrails (>=0.0.0-20251106131028 <=0.16.0) +7399 more potentially affected by CVE-2026-44487 via axios (>=1.0.0 <=1.15.2)

axios NPM version =1.0.0, =0.0.8, =0.0.0-20251106131028, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =0.0.2-beta.0, =8.0.5, =6.1.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.0.1-alpha.3, =0.1.6-alpha.11, =0.1.6-alpha.12 and more Source cves: CVE-2026-44487 Source advisory:...

a2 (>=0.1.0 <=0.3.17), abnativ (>=1.1.0 <=1.2.9) +347 more potentially affected by CVE-2026-10803 via mlflow (>=0.8.2 <=3.10.0)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =0.1.0, =1.7.0, =1.7.0, =1.8.0, =1.7.0, =1.7.0, =0.1.1, =0.1.5 - anovos =1.1.0 and more Source cves: CVE-2026-10803 Source advisory: OSV:PYSEC-2026-195...

ate (>=0.1.0 <=0.8.0), ate-auth (>=1.1.0 <=1.6.0) +67 more potentially affected by unknown CVE via pqcrypto-internals (>=0.1.0 <=0.2.11)

pqcrypto-internals CARGO version =0.1.0, =0.1.0, =1.1.0, =1.0.0, =1.1.0, =2.0.0, =0.1.2-alpha, =0.1.4, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.2 - envencryptiontool =0.9.17 - ever-crypto =0.1.0 - hanzo-agentic =1.1.21 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0163...

crypt_guard (=0.1.4), env_encryption_tool (=0.9.17) +7 more potentially affected by unknown CVE via pqcrypto (>=0.11.1 <=0.18.1)

pqcrypto CARGO version =0.11.1, =0.1.0, =0.1.0, =0.1.2, =0.1.0, =0.23.0, =0.23.0, =12.0.2 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0164...

aquadoggo (=0.1.0), askama_tide (>=0.10.0 <=0.15.0) +151 more potentially affected by unknown CVE via tide (>=0.0.5 <=0.9.0)

tide CARGO version =0.0.5, =0.10.0, =0.9.0, =1.14.10, =0.2.0, =2.0.0, =1.0.1, =0.1.0, =0.4.1, =6.0.0, =0.1.2, =0.0.4, =0.1.13, =0.4.0, =0.5.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0170...

crypt_guard (=0.1.4), env_encryption_tool (=0.9.17) +3 more potentially affected by unknown CVE via pqcrypto-classicmceliece (>=0.1.7 <=0.2.1)

pqcrypto-classicmceliece CARGO version =0.1.7, =0.12.2, =0.18.1 - pqcrypto-compat =0.1.0 - qfe =0.4.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0167...

@accounter/client (>=0.0.3 <=0.0.12-alpha-20260421081155-bb6cc4c0b0b59fff41df172e2f4212eca6906193), @appigram/react-code-split-ssr (=1.3.7) +157 more potentially affected by CVE-2026-40181 via react-router (>=7.0.0 <=7.14.0)

react-router NPM version =7.0.0, =0.0.3, =0.0.2, =3.5.2, =1.1.0, =1.0.1-MON-198808-web-js-deps-batch-1.0, =0.0.1, =3.4.9, =0.1.9, =0.3.1, =0.5.1 and more Source cves: CVE-2026-40181 Source advisory: OSV:GHSA-2J2X-HQR9-3H42...

aa-altcorp (>=0.1.2b0 <=1.1.1), aa-alumni (>=0.0.1a1 <=1.0.1) +1421 more potentially affected by CVE-2026-6873 via django (>=5.2.0 <=5.2.14)

django PYPI version =5.2.0, =0.1.2b0, =0.0.1a1, =0.1.1, =3.1.0b1, =1.0.3, =0.0.1a2, =0.1.0, =0.2.0, =1.0.0, =1.1.0b3, =0.1.0b1, =0.1.0, =1.1.0 and more Source cves: CVE-2026-6873 Source advisory: OSV:PYSEC-2026-199...

edf-centrifuge (=1.0.0) potentially affected by CVE-2026-35212 via pycti (=6.9.29)

pycti PYPI version =6.9.29 is affected by a known vulnerability. The following packages have a transitive dependency on pycti and may be impacted: - edf-centrifuge =1.0.0 Source cves: CVE-2026-35212 Source advisory: OSV:PYSEC-2026-203...

airflow-balancer (>=0.7.0 <=0.7.6), airflow-clickhouse-plug (=1.6.2) +38 more potentially affected by CVE-2026-45426 via apache-airflow (>=3.0.0 <=3.2.1rc3)

apache-airflow PYPI version =3.0.0, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0, =0.1.0, =1.4.3, =1.2.10, =0.1.1, =3.0.0, =1.6.0, =1.5.3, =1.25.0, =3.12.0, =3.12.0rc1 and more Source cves: CVE-2026-45426 Source advisory: OSV:PYSEC-2026-174...

a2a-lite (>=0.1.0 <=0.2.2), adb-connect-qr (>=0.1.0 <=0.1.3) +556 more potentially affected by CVE-2026-47180 via zeroconf (>=0.140.1 <=0.149.3)

zeroconf PYPI version =0.140.1, =0.1.0, =0.1.0, =0.1.0, =1.0.2, =1.0.1, =0.0.1, =1.4.8, =2.6.28, =0.7.1, =0.0.1, =1.7.0, =0.2.38, =3.2.20 and more Source cves: CVE-2026-47180 Source advisory: OSV:GHSA-9PGC-3CCV-5297...

@typebot.io/react (=0.10.0) potentially affected by CVE-2026-28445 via @typebot.io/js (=0.10.0)

@typebot.io/js NPM version =0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on @typebot.io/js and may be impacted: - @typebot.io/react =0.10.0 Source cves: CVE-2026-28445 Source advisory: OSV:GHSA-6M7C-XFHP-P9FH...

claude-content-writer (=2.1.0) potentially affected by unknown CVE via claude-content-writer (=2.2.0)

claude-content-writer NPM version =2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on claude-content-writer and may be impacted: - claude-content-writer =2.1.0 Source cves: unknown CVE Source advisory: OSV:MAL-2026-4524...

monerochan-stark (>=5.2.2 <=5.2.12), p3-circle (>=0.1.0 <=0.4.3-succinct) +30 more potentially affected by CVE-2026-46654 via p3-challenger (>=0.1.0 <=0.4.3-succinct)

p3-challenger CARGO version =0.1.0, =5.2.2, =0.1.0, =0.1.0, =0.1.0, =0.1.5-succinct, =0.1.0, =0.1.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.2 and more Source cves: CVE-2026-46654 Source advisory: OSV:GHSA-VJ64-RJF3-W3V7...