GHSA-2V37-7H3G-55P8 vulnerabilities

Vulnerabilities for packages: unleash-fips, arangodb, jitsucom-jitsu, langfuse-fips, renovate, langfuse, unleash, json-server, gitlab-rails-ce, nextcloud-server, dotstatsuite-supercore...

GHSA-JR45-8VMC-QM54 vulnerabilities

Vulnerabilities for packages: vitess, renovate, code-server, langfuse...

GHSA-8XCM-R25X-G524 vulnerabilities

Vulnerabilities for packages: prism, langfuse, vitess, npm, pulumi, code-server, renovate...

GHSA-34XG-WGJX-8XPH vulnerabilities

Vulnerabilities for packages: nextcloud-server...

GHSA-VMF3-W455-68VH vulnerabilities

Vulnerabilities for packages: pnpm-stage0, opensearch-dashboards, thingsboard-fips, saf, pulumi, renovate, py3-jupyterlab, gitlab-rails-ce, npm, drupal, wazuh-dashboard-fips, prism, wazuh-dashboard, homepage, py3-captum, actions-runner, gemini-cli, kibana, tileserver-gl-fips, lerna,...

GHSA-H67P-54HQ-RP68 vulnerabilities

Vulnerabilities for packages: lerna, vitess, kubeflow-katib, thingsboard, code-server, tileserver-gl, opensearch-dashboards, langfuse, sqlpad, eslint, prism, py3-jupyterlab, ts-patch, pulumi, renovate, kubeflow-pipelines, airflow, saf, argo-workflows...

CLEANSTART-2026-EA12165 Security fixes for CVE-2025-61732, CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-26958, CVE-2026-27136, CVE-2026-27139, CVE-2026-27142, CVE-2026-27145, CVE-2026-33186, CVE-2026-33811, CVE-2026-33814, CVE-2026-33816, CVE-2026-34986, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-42499, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-273p-m2cw-6833, ghsa-4c4x-jm2x-pf9j, ghsa-4qg8-fj49-pxjh, ghsa-846p-jg2w-w324, ghsa-fcv2-xgw5-pqxf, ghsa-fphv-w9fq-2525, ghsa-jqc5-w2xx-5vq4, ghsa-pmwq-pjrm-6p5r, ghsa-whqx-f9j3-ch6m, ghsa-xmrv-pmrh-hhx2 applied in versions: 1.14.1-r0, 1.14.1-r1, 1.14.1-r2, 1.14.1-r3, 1.14.1-r4, 1.14.5-r0, 1.14.5-r1

Multiple security vulnerabilities affect the spire-server package. These issues are resolved in later releases. See references for individual vulnerability details...

vantage6-algorithm-store (>=4.3.0 <=4.15.1rc1), vantage6-node (>=0.0.0 <=4.15.1rc1) +1 more potentially affected by CVE-2024-24769 via vantage6 (>=0.0.0 <=4.9.1)

vantage6 PYPI version =0.0.0, =4.3.0, =0.0.0, =0.0.0, =4.15.1rc1 Source cves: CVE-2024-24769 Source advisory: OSV:GHSA-5549-C5Q7-FJ65...

budibase (>=0.0.3 <=0.0.31) potentially affected by CVE-2026-45717 via @budibase/server (>=0.0.1 <=0.0.9)

@budibase/server NPM version =0.0.1, =0.0.3, =0.0.31 Source cves: CVE-2026-45717 Source advisory: OSV:GHSA-44M2-CRH7-F4Q2...

@paperclipai/server (>=2026.3.17-canary.2 <=2026.416.0-canary.1), companies.sh (>=2026.324.0-canary.0 <=2026.325.0-canary.3) +4 more potentially affected by unknown CVE via @paperclipai/db (>=2026.318.0-canary.0 <=2026.416.0-canary.1)

@paperclipai/db NPM version =2026.318.0-canary.0, =2026.3.17-canary.2, =2026.324.0-canary.0, =2026.3.17-canary.3, =0.6.5, =0.6.6 Source cves: unknown CVE Source advisory: SNYK:JS-PAPERCLIPAIDB-16421488...

GHSA-5RQ4-664W-9X2C vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, code-server, langfuse...

CLEANSTART-2026-AU31441 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the metrics-server-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

GHSA-3F26-J6R7-9Q8V vulnerabilities

Vulnerabilities for packages: xorg-server...

GHSA-6RW7-VPXM-498P vulnerabilities

Vulnerabilities for packages: kubeflow-centraldashboard, opensearch-dashboards, kubeflow-pipelines, saf, redisinsight, renovate, langfuse, py3-jupyterlab, gitlab-rails-ce, arangodb, argo-workflows, librechat, kibana, tileserver-gl-fips, opensearch-dashboards-fips, langfuse-fips, code-server,...

@nocobase/devtools (>=2.0.0-alpha.2 <=2.0.0-alpha.51), @nocobase/server (>=2.0.0-alpha.2 <=2.0.0-alpha.51) +1 more potentially affected by CVE-2025-13877 via @nocobase/auth (>=2.0.0-alpha.2 <=2.0.0-alpha.51)

@nocobase/auth NPM version =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.51 Source cves: CVE-2025-13877 Source advisory: SNYK:JS-NOCOBASEAUTH-14287473...

EUVD-2025-124231

Malicious code in npm-server-mui-pm2 npm...

EUVD-2025-35680

Malicious code in demo-mercadopago-mcp-server npm...

EUVD-2020-0650

Malware in sbrugna...

MAL-2025-42116 Malicious code in wealthsimple-mcp-server (npm)

The package wealthsimple-mcp-server was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 7cd49239ea1d9566f39581393c8553ea1a1733f9ddb3a6dfc09ef5ad0c507122 This package installs a dependency hosted on a custom domain that...

MAL-2025-39296 Malicious code in win-server (npm)

The package win-server was found to contain malicious code...