@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70607 via electron (>=40.0.0, <=40.8.5)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70607 Source advisory: SNYK:JS-ELECTRON-18565025...

20mk-utils (>=1.0.0, <=1.0.3), 2d-spirograph (>=1.0.2, <=1.0.4) +2106 more potentially affected by CVE-2026-59711 via showdown (>=0.0.1, <=2.1.0)

showdown NPM version =0.0.1, =1.0.0, =1.0.2, =2.0.4, =1.0.6, =0.1.4, =0.1.4, =0.1.4, =13.351.0, =13.351.0, =7.10.0, =7.10.0, =0.0.3, =0.5.1 - @adalink/spark-chat 1.0.0 and more Source cves: CVE-2026-59711 Source advisory: SNYK:JS-SHOWDOWN-17874448...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53825 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53825 Source advisory: OSV:GHSA-P2FH-F5FC-44HR...

Important: jpegxl

Issue Overview: Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc. CVE-2025-70103 Affected Packages: jpegxl Issue Correction: Run dnf update jpegxl --releasever 2023.12.20260622 or dnf update...

31g-form-parser (1.0.107), @accounter/client (>=0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, <=0.0.12-alpha-20260508071110-20f5becdec9522d09c6a97f123f7c572407661fb) +379 more potentially affected by CVE-2026-42342 via react-router (>=7.0.0, <=7.14.2)

react-router NPM version =7.0.0, =0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2, =3.4.0, =2026.511.1, =0.2.3, =0.3.7 and more Source cves: CVE-2026-42342 Source advisory: SNYK:JS-REACTROUTER-17138701...

aurora-cycler-manager (>=0.10.0, <=0.11.4), fusion-tools (>=3.6.19, <=3.6.97) +9 more potentially affected by CVE-2026-38361 via dash-uploader (>=0.6.0, <=0.7.0a2)

dash-uploader PYPI version =0.6.0, =0.10.0, =3.6.19, =0.0.11, =0.0.30, =0.2.4b0, =0.0.50.0, =0.1.7.3, =2.0.1, =0.2.0, =0.4.1 Source cves: CVE-2026-38361 Source advisory: SNYK:PYTHON-DASHUPLOADER-16635848...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (0.8.3-beta.1) +11 more potentially affected by CVE-2026-35651 via openclaw (>=2026.3.22, <=2026.3.24-beta.2)

openclaw NPM version =2026.3.22, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-35651 Source advisory: SNYK:JS-OPENCLAW-15812230...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +217 more potentially affected by CVE-2026-86251 via h3 (>=1.0.1, <=1.15.6)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: CVE-2026-86251 Source advisory: OSV:GHSA-72GR-QFP7-VWHW...

@dxos/storybook-utils (>=0.8.4-main.9735255, <=0.11.1), @payfit/unity-components (>=2.1.4, <=2.9.6) +8 more potentially affected by CVE-2026-27148 via storybook (>=10.0.0, <=10.2.9)

storybook NPM version =10.0.0, =0.8.4-main.9735255, =2.1.4, =10.0.0-beta.0, =10.0.0-beta.0, =12.0.7, =12.0.5, =1.2.0, =10.0.0-beta.0, =10.0.0-beta.0, =10.2.9 - storybook-renku 0.0.2 Source cves: CVE-2026-27148 Source advisory: OSV:GHSA-MJF5-7G4M-GX5W...

3llm (0.0.1), @3bitmt/3bit-sidebar-dashboard (1.1.4) +269 more potentially affected by unknown CVE via next (>=15.1.1, <=15.1.11)

next NPM version =15.1.1, =0.0.4-alpha-20241218130538-b1235534784f95b3524711b50802add67747c676, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.1, =0.1.1, =0.1.0, =1.0.0, =1.0.6 - @axle-energy/components 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H25M-26QC-WCJF...

@diningcity/capacitor-qr-scanner (>=0.0.7, <=0.0.8), @mojitonft/hooks (1.0.1-alpha.4) +93 more potentially affected by CVE-2025-26278 via dref (0.0.6)

dref NPM version 0.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on dref and may be impacted: - @diningcity/capacitor-qr-scanner =0.0.7, =1.7.0, =0.0.1, =11.1.1, =3.3.3, =0.0.0-beta, =0.0.2, =1.0.2, =0.0.40, =0.0.2, =0.0.1, =0.0.1, =0.1.0, =0.1.19 a...

GHSA-2X5J-VHC8-9CWM vulnerabilities

Vulnerabilities for packages: hydra, policy-controller, go-licenses, crossplane-provider-aws-cloudfront, opentofu, ksops, crossplane-provider-keycloak, crossplane-provider-azure-storage, kyverno-notation-aws, crossplane-provider-family-aws, pulumi-language-dotnet, snyk-cli, lazygit, atlantis, xeo...

Ubuntu: Security Advisory (USN-7364-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

@appknit-project/appknit-internal-sdk (>=1.0.98-alpha.0, <=1.0.98-alpha.11), @appknit-project/appknit-platform-sdk-v2 (>=1.3.65-alpha.0, <=1.3.65-alpha.10) +97 more potentially affected by CVE-2024-21534 via jsonpath-plus (>=10.0.0, <=10.1.0)

jsonpath-plus NPM version =10.0.0, =1.0.98-alpha.0, =1.3.65-alpha.0, =0.18.0-alpha.0, =0.17.3, =0.18.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.12, =0.0.13 and more Source cves: CVE-2024-21534 Source advisory: OSV:GHSA-PPPG-CPFQ-H7WR...

The vulnerability of the `createSessionInternal` function in the `PackageInstallerService.java` module of the Android operating system allows a hacker to access the database of any application.

The vulnerability of the createSessionInternal function in the PackageInstallerService.java module of the Android operating system is related to the lack of encapsulation around special characters in the name of the installer when it is written to /data/system/packages.list. Exploiting this...

0me.sh (0.1.15), 0xrtest (1.0.0) +2410 more potentially affected by CVE-2024-29415 via ip (>=2.0.0, <=2.0.1)

ip NPM version =2.0.0, =1.0.1, =0.0.1, =1.0.3, =0.0.11, =0.0.0-experimental-827-react-checked-states, =0.0.0-experimental-827-react-checked-states, =3.5.0-rc.1 and more Source cves: CVE-2024-29415 Source advisory: OSV:GHSA-2P57-RM9W-GVFP...

@amedia/user (>=0.1.0, <=0.3.2), @aztec/alpha-sdk (2.2.0) +65 more potentially affected by CVE-2022-21189 via dexie (>=3.0.0, <=3.2.1)

dexie NPM version =3.0.0, =0.1.0, =2.1.0-testnet.79, =2.2.0-alpha.5, =0.0.1-beta.1, =0.2.20, =0.14.37, =1.0.0, =2.2.0-alpha.3, =0.5.7, =0.5.7, =0.14.3, =0.0.3, =0.0.3, =0.0.9 and more Source cves: CVE-2022-21189 Source advisory: OSV:GHSA-3XGX-R9J4-QW9W...

@asephermann/capacitor-filechooser (0.0.1), @jewel998/mock-location (>=0.0.9, <=0.0.10) +53 more potentially affected by unknown CVE via mixme (>=0.0.1, <=0.4.0)

mixme NPM version =0.0.1, =0.0.9, =1.0.1, =0.0.1, =0.9.3-alpha.5, =0.0.1-alpha.1, =0.9.7-alpha.0, =0.8.1-alpha.0, =0.0.1-alpha.1, =0.2.1-alpha.1, =0.0.2-alpha.0, =0.0.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-84P7-FH9C-6G8H...

@atlauncher/atlauncher-scripts (>=0.1.0-18, <=0.1.0-19), @atomist/sample-sdm (>=0.5.1-atomist-update-latest-1540938130032.20181101043939, <=0.5.1-master.20181101044648) +415 more potentially affected by unknown CVE via lodash.merge (>=4.0.1, <=4.6.1)

lodash.merge NPM version =4.0.1, =0.1.0-18, =0.5.1-atomist-update-latest-1540938130032.20181101043939, =5.3.8, =3.1.0, =5.0.0, =5.2.7, =5.2.8, =6.1.1, =5.0.0, =5.0.0, =5.2.8, =5.1.1, =0.1.3, =6.2.6, =6.3.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H726-X36V-RX45...

CVE-2020-10871: Exposure of Sensitive Information to an Unauthorized Actor

In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report because, for instances reachable by an unauthenticated actor, the same information is available in other more complex ways...