@saltcorn/cli (>=1.0.0-beta.1, <=1.4.5), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.5) potentially affected by CVE-2026-42259 via @saltcorn/server (>=1.0.0, <=1.4.5)

@saltcorn/server NPM version =1.0.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.5 Source cves: CVE-2026-42259 Source advisory: SNYK:JS-SALTCORNSERVER-16111017...

@saltcorn/admin-models (>=1.5.0-beta.0, <=1.5.5), @saltcorn/base-plugin (>=1.5.0-beta.0, <=1.5.5) +5 more potentially affected by CVE-2026-41478 via @saltcorn/data (>=1.5.0, <=1.5.5-beta.0)

@saltcorn/data NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNDATA-16110991...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5) potentially affected by CVE-2026-41478 via @saltcorn/server (>=1.5.0, <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5 Source cves: CVE-2026-41478 Source advisory: OSV:GHSA-JP74-MFRX-3QVH...

companies.sh (>=2026.324.0-canary.0, <=2026.325.0-canary.3), corporateai (2026.328.0-canary.0) +3 more potentially affected by unknown CVE via @paperclipai/server (>=2026.3.17-canary.3, <=2026.415.0-canary.7)

@paperclipai/server NPM version =2026.3.17-canary.3, =2026.324.0-canary.0, =2026.3.17-canary.3, =0.6.5, =0.6.6 Source cves: unknown CVE Source advisory: OSV:GHSA-VR7G-88FQ-VHQ3...

companies.sh (>=2026.324.0-canary.0, <=2026.325.0-canary.3), corporateai (2026.328.0-canary.0) +3 more potentially affected by CVE-2026-41208 via @paperclipai/server (>=2026.3.17-canary.3, <=2026.415.0-canary.7)

@paperclipai/server NPM version =2026.3.17-canary.3, =2026.324.0-canary.0, =2026.3.17-canary.3, =0.6.5, =0.6.6 Source cves: CVE-2026-41208 Source advisory: OSV:GHSA-265W-RF2W-CJH4...

companies.sh (>=2026.324.0-canary.0, <=2026.325.0-canary.3), corporateai (2026.328.0-canary.0) +3 more potentially affected by unknown CVE via @paperclipai/server (>=2026.3.17-canary.3, <=2026.415.0-canary.7)

@paperclipai/server NPM version =2026.3.17-canary.3, =2026.324.0-canary.0, =2026.3.17-canary.3, =0.6.5, =0.6.6 Source cves: unknown CVE Source advisory: SNYK:JS-PAPERCLIPAISERVER-16421450...

@20syldev/api (>=2.6.0, <=2.8.0), @aalis/plugin-tool-math (>=0.1.0, <=0.9.1) +507 more potentially affected by CVE-2026-40897 via mathjs (>=13.1.1, <=15.1.1)

mathjs NPM version =13.1.1, =2.6.0, =0.1.0, =1.3.0, =2.0.0, =0.2.6, =0.3.0, =7.0.0, =7.0.0, =0.1.14, =0.13.1, =5.0.95, =1.0.0, =1.3.0-alpha.0 - @antsoo-lib/components 0.0.1 - @antsoo-lib/hooks 0.0.1 and more Source cves: CVE-2026-40897 Source advisory: OSV:GHSA-29QV-4J9F-FJW5...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-6270 via @fastify/middie (>=9.0.2, <=9.3.1)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.69 Source cves: CVE-2026-6270 Source advisory: SNYK:JS-FASTIFYMIDDIE-16098213...

@activeboxes/piece-sftp (0.2.6), @activepieces/piece-apify (0.2.1) +26 more potentially affected by CVE-2026-41324 via basic-ftp (>=5.0.2, <=5.2.2)

basic-ftp NPM version =5.0.2, =0.2.6, =1.0.0, =1.0.0, =2.0.18, =1.9.2, =1.2.0, =4.6.0-blowfish, =1.0.3, =1.0.4, =1.0.5 - @neurarank/node-sftp 0.4.3 and more Source cves: CVE-2026-41324 Source advisory: OSV:GHSA-RP42-5VXX-QPWR...

@aurora-nexus/aurora-nexus-design-system (0.2.0), @fireproof/core-protocols-dashboard (>=0.24.3-dev-20261224, <=0.24.12) +6 more potentially affected by CVE-2026-41248 via @clerk/shared (>=3.36.0, <=3.45.1)

@clerk/shared NPM version =3.36.0, =0.24.3-dev-20261224, =0.24.3-dev-20261224, =0.24.3-dev-20261224, =0.0.14, =0.18.25-dev, =0.24.3-dev-20261224, =0.18.25-dev, =0.18.28-dev Source cves: CVE-2026-41248 Source advisory: OSV:GHSA-VQX2-FGX2-5WQ9...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Orchestrator

Summary Multiple vulnerabilities were addressed in IBM Aspera Orchestrator 4.1.4 Vulnerability Details CVEID:CVE-2026-33173 DESCRIPTION: Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, DirectUploadsController...

@appwise/oauth2-server (>=0.0.19, <=0.2.2), @dyne/slangroom-chain (>=1.4.0, <=1.16.10) +4 more potentially affected by CVE-2026-41213 via @node-oauth/oauth2-server (>=5.0.0, <=5.2.1)

@node-oauth/oauth2-server NPM version =5.0.0, =0.0.19, =1.4.0, =1.3.0, =1.49.1, =1.0.0, =1.0.0, =1.0.1 Source cves: CVE-2026-41213 Source advisory: OSV:GHSA-JHM7-29PJ-4XVF...

@aumoai/mcp-data-analyst (>=0.1.0, <=0.2.8), @geobio/code_execution_server (>=0.2.0, <=0.2.1) +35 more potentially affected by CVE-2026-39313 via mcp-framework (>=0.1.27, <=0.2.15)

mcp-framework NPM version =0.1.27, =0.1.0, =0.2.0, =1.0.11, =0.2.0, =0.2.0, =0.0.1, =0.0.4 and more Source cves: CVE-2026-39313 Source advisory: SNYK:JS-MCPFRAMEWORK-16420257...

CVE-2026-3324

The CVE-2026-3324 issue affects Zohocorp ManageEngine Log360 versions 13000–13013, where authentication bypass can occur on certain actions due to improper filter configuration. The root cause is misconfigured access filters, enabling unauthorized access without credentials. The CVSSv3.1 base met...

EUVD-2026-23215

In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X aka --xattrs. On Linux, many but not all common configurations are vulnerable. Non-Linux platforms are more widely vulnerable...

CVE-2026-41015

radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP. NOTE: although users are supposed to use the latest version from git not a release, the date range for the vulnerable code was less than a week, occurring after 6.1.2 but before 6.1...

EUVD-2026-23114

Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role...

Yamaha SR-B30A 安全漏洞

The Yamaha SR-B30A is a bar-style audio device produced by the Japanese company Yamaha. Version 2.40 of the Yamaha SR-B30A contains a security vulnerability. This vulnerability stems from the Bluetooth low-power control interface, which allows unauthorized connections without authentication. This...

PT-2026-33247

radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP. NOTE: although users are supposed to use the latest version from git not a release, the date range for the vulnerable code was less than a week, occurring after 6.1.2 but before 6.1...

The vulnerability of Microsoft Excel’s spreadsheet editor, related to reading data beyond the allowed range in memory, allows an attacker to disclose protected information.

The vulnerability of Microsoft Excel spreadsheet editors involves reading data beyond the allowable range in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...