com.armanbilge:feral-lambda-cloudformation-custom-resource_2.12 (>=0.1-f497734, <=0.1-7d4b1e7), com.armanbilge:sbt-bundlemon_2.12_1.0 (0.1.4) +69 more potentially affected by CVE-2026-69206 via org.http4s:http4s-ember-core_2.12 (>=0.10.0-m10, <=0.23.34)

org.http4s:http4s-ember-core2.12 MAVEN version =0.10.0-m10, =0.1-f497734, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.0.0-3-cca5341b, =0.0.0-3-cca5341b, =7.1.0, =0.21.0, =0.20.4, =0.21.0, =0.21.0, =0.22.1 and more Source cves: CVE-2026-69206 Source advisory: MEND:CVE-2026-69206...

GHSA-M2PW-22CJ-JQ4V

creationtimestamp| type| source ---|---|--- 2026-08-10 21:27:13+00:00| seen| https://bsky.app/profile/scala-lang.org/post/3msr24brbfc2h...

PT-2026-60700

Name of the Vulnerable Software and Affected Versions Jawn versions prior to 1.7.0 Description The AsyncParser component can perform quadratic work when a single JSON token is delivered across many small chunks, as each absorb call rescans the incomplete token from the beginning. A remote attacke...

Malicious Package

Overview @sbtgitverse/analytics-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @sbt_gitverse/analytics-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2858d6765b337bc72b69faaa1a64e528931e8230756aa8a1d5ab4e58793357a The package @sbtgitverse/analytics-client was found to contain malicious code. Source: ghsa-malware...

CVE-2026-32948

sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process"cmd", "/c", ... to run VCS commands git, hg, svn. The URI fragment branch, tag, revision is user-controlled via the build definition and passed to these commands without...

CVE-2026-32948 sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows

sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process"cmd", "/c", ... to run VCS commands git, hg, svn. The URI fragment branch, tag, revision is user-controlled via the build definition and passed to these commands without...

CVE-2026-32948

sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process"cmd", "/c", ... to run VCS commands git, hg, svn. The URI fragment branch, tag, revision is user-controlled via the build definition and passed to these commands without...

org.scala-sbt:sbt (>=0.99.2, <=1.0.0-m4), org.scala-sbt:scripted-plugin_2.10 (>=0.99.2, <=1.0.0-m4) +1 more potentially affected by CVE-2026-32948 via org.scala-sbt:main_2.11 (>=0.99.2, <=1.0.0-m4)

org.scala-sbt:main2.11 MAVEN version =0.99.2, =0.99.2, =0.99.2, =0.99.2, =1.0.0-m4 Source cves: CVE-2026-32948 Source advisory: SNYK:JAVA-ORGSCALASBT-15763414...

Command Injection

Overview org.scala-sbt:main2.12 is a sbt is an interactive build tool Affected versions of this package are vulnerable to Command Injection in the Process"cmd", "/c", ... used to execute VCS commands on Windows when handling user-controlled URI fragments. An attacker can execute arbitrary Windows...

PT-2026-27306

sbt 1.12.7 is released, featuring a security fix for CVE-2026-32948, Source dependency feature via crafted VCS URL leading to arbitrary code execution on Windows...

CVE-2026-32948: Improper Neutralization of Special Elements used in an OS Command

sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process"cmd", "/c", ... to run VCS commands git, hg, svn. The URI fragment branch, tag, revision is user-controlled via the build definition and passed to these commands without...

ch.admin.bit.jeap:jeap-message-contract-domain (>=3.26.0, <=4.11.0), ch.admin.bit.jeap:jeap-message-contract-messagetype-registry (>=3.26.0, <=4.11.0) +54 more potentially affected by CVE-2025-33042 via org.apache.avro:avro-compiler (1.12.0)

org.apache.avro:avro-compiler MAVEN version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.avro:avro-compiler and may be impacted: - ch.admin.bit.jeap:jeap-message-contract-domain =3.26.0, =3.26.0, =3.26.0, =3.26.0, =8.15.0, =8.15.0,...

ch.admin.bit.jeap:jeap-message-contract-domain (>=3.26.0, <=4.11.0), ch.admin.bit.jeap:jeap-message-contract-messagetype-registry (>=3.26.0, <=4.11.0) +54 more potentially affected by CVE-2025-33042 via org.apache.avro:avro-compiler (1.12.0)

org.apache.avro:avro-compiler MAVEN version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.avro:avro-compiler and may be impacted: - ch.admin.bit.jeap:jeap-message-contract-domain =3.26.0, =3.26.0, =3.26.0, =3.26.0, =8.15.0, =8.15.0,...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +24512 more potentially affected by CVE-2025-68161 via org.apache.logging.log4j:log4j-core (>=2.0-beta9, <=2.25.2)

org.apache.logging.log4j:log4j-core MAVEN version =2.0-beta9, =0.14.1, =0.1.0, =0.9.6, =0.12.0, =0.9.6, =0.9.6, =0.9.6, =0.9.6, =0.14.1, =0.9.6, =0.14.1, =4.4.0.0, =1.4.6, =1.4.6, =1.4.9 and more Source cves: CVE-2025-68161 Source advisory: OSV:GHSA-VC5P-V9HR-52MJ...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +24512 more potentially affected by CVE-2025-68161 via org.apache.logging.log4j:log4j-core (>=2.0-beta9, <=2.25.2)

org.apache.logging.log4j:log4j-core MAVEN version =2.0-beta9, =0.14.1, =0.1.0, =0.9.6, =0.12.0, =0.9.6, =0.9.6, =0.9.6, =0.9.6, =0.14.1, =0.9.6, =0.14.1, =4.4.0.0, =1.4.6, =1.4.6, =1.4.9 and more Source cves: CVE-2025-68161 Source advisory: MEND:CVE-2025-68161...

com.cyclonedx:cyclonedx-gradle-plugin (>=1.1.2, <=1.5.0), com.free-now.sauron.plugins:dependency-checker (>=0.0.57, <=0.0.74) +102 more potentially affected by CVE-2025-64518 via org.cyclonedx:cyclonedx-core-java (>=2.1.1, <=11.0.0)

org.cyclonedx:cyclonedx-core-java MAVEN version =2.1.1, =1.1.2, =0.0.57, =1.0.0, =0.4.0, =1.0.0, =1.0.0, =0.9.0, =0.120.0, =0.9.0, =0.105.0, =0.157.0, =0.157.0, =0.137.0, =0.115.0, =0.9.0, =0.125.0 and more Source cves: CVE-2025-64518 Source advisor...

EUVD-2023-2746

Malicious code in bioql PyPI...

CVE-2023-46122

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorizedkeys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however...

Moderate: Red Hat Security Advisory: Red Hat AMQ Streams 2.5.2 release and security update

Red Hat AMQ Streams 2.5.2 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...