@powersync/cli-core (>=0.0.0-dev-20260305082615, <=0.9.2), @powersync/cli-plugin-config-edit (>=0.0.0-dev-20260305082615, <=0.9.2) +12 more potentially affected by CVE-2026-30870 via @powersync/service-core (1.20.0)

@powersync/service-core NPM version 1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on @powersync/service-core and may be impacted: - @powersync/cli-core =0.0.0-dev-20260305082615, =0.0.0-dev-20260305082615, =0.0.0-dev-20260305082615,...

CVE-2026-25921

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2...

@george.talusan/node-red-contrib-copilot (>=0.0.5, <=1.0.5), @github/copilot-sdk (>=0.1.9, <=0.1.31-unstable.0) +19 more potentially affected by CVE-2026-29783 via @github/copilot (>=0.0.375, <=0.0.421)

@github/copilot NPM version =0.0.375, =0.0.5, =0.1.9, =1.1.0, =0.0.0, =0.13.0, =0.0.1, =1.2.3, =0.6.0, =1.0.1, =0.1.0, =1.0.0, =1.0.0, =1.0.15 - devdoctor-js 0.1.0 and more Source cves: CVE-2026-29783 Source advisory: OSV:GHSA-G8R9-G2V8-JV6F...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the handling of LFS object uploads. An attacker can overwrite existing LFS objects across different repositories by uploading objects with the same identifier, potentially leading to...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the handling of LFS object uploads. An attacker can overwrite existing LFS objects across different repositories by uploading objects with the same identifier, potentially leading to...

CVE-2026-25921

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2...

CVE-2026-25921

Gogs (self-hosted Git service) prior to version 0.14.2 is affected by an issue where overwritable LFS objects across different repositories can be maliciously overwritten, enabling a supply-chain-style risk. The underlying problem is an LFS object overwrite vulnerability that affects all LFS obje...

CVE-2026-25921

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2...

CVE-2026-25921 Gogs: Cross-repository LFS object overwrite via missing content hash verification

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2...

CVE-2026-26034

UPS Multi-UPS Management Console MUMC version 01.06.0001 A03 contains an Incorrect Default Permissions CWE-276 vulnerability that allows an attacker to execute arbitrary code with SYSTEM privileges by causing the application to load a specially crafted DLL...

PT-2026-23126

Name of the Vulnerable Software and Affected Versions UPS Multi-UPS Management Console MUMC version 01.06.0001 A03 Description The UPS Multi-UPS Management Console MUMC version 01.06.0001 A03 contains an Unquoted Search Path or Element issue. This allows a user with write access to a directory on...

PT-2026-23127

Name of the Vulnerable Software and Affected Versions UPS Multi-UPS Management Console MUMC version 01.06.0001 A03 Description The UPS Multi-UPS Management Console MUMC version 01.06.0001 A03 has an issue related to incorrect default permissions. This allows an attacker to execute arbitrary code...

Cyber Threat Intelligence for Artificial Intelligence Systems

As artificial intelligence AI becomes deeply embedded in critical services and everyday products, it is increasingly exposed to security threats which traditional cyber defenses were not designed to handle. In this paper, we investigate how cyber threat intelligence CTI may evolve to address...

Gogs（Go Git Service） 数据伪造问题漏洞

Gogs Go Git Service is a Go-based self-service Git hosting service developed by the Gogs team. It supports creating and migrating public/private repositories, as well as adding and removing repository collaborators. Prior to version 0.14.2 of Gogs Go Git Service, there was a data manipulation...

@zextras/carbonio-admin-ui (>=0.4.4-devel.1654173975013, <=0.9.28), @zextras/carbonio-design-system (>=0.1.3-devel.0, <=12.0.3) +9 more potentially affected by CVE-2025-68467 via darkreader (>=4.7.15, <=4.9.105)

darkreader NPM version =4.7.15, =0.4.4-devel.1654173975013, =0.1.3-devel.0, =0.3.0-devel.1642600405487, =0.1.0-beta.12, =0.1.0-beta.6, =0.1.0-beta.0, =1.1.11, =0.1.1-beta.0, =2.1.0, =2.2.0 - samagra-ui 1.0.1 Source cves: CVE-2025-68467 Source advisory: OSV:GHSA-X369-MCW8-8RVJ...

SUSE CVE-2026-24845

malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. malcontent uses...

ai-dynamo (>=0.1.0, <=0.3.0), bento-sgl-router (>=0.0.1, <=0.0.6) +31 more potentially affected by CVE-2026-27905 via bentoml (>=0.9.2, <=1.4.39)

bentoml PYPI version =0.9.2, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.2.3, =0.0.1, =0.0.10, =0.1.0, =0.2.0, =0.0.1, =0.3.12.dev20240709150559, =0.3.52 and more Source cves: CVE-2026-27905 Source advisory: SNYK:PYTHON-BENTOML-15372202...

Pentagon ditches Anthropic AI over &#8220;security risk&#8221; and OpenAI takes over

On Friday the US Pentagon cut ties with Anthropic, the company behind Claude AI. Defense Secretary Pete Hegseth designated the San Francisco-based company a "supply-chain risk to national security." The supply-chain risk designation means that no contractor, supplier, or partner doing business wi...

@dyyxyzz/baileys-mod (>=6.0.32, <=6.0.54) potentially affected by unknown CVE via @daffadeveloper/libsignal-node (0.0.1-security)

@daffadeveloper/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @daffadeveloper/libsignal-node and may be impacted: - @dyyxyzz/baileys-mod =6.0.32, =6.0.54 Source cves: unknown CVE Source advisory:...

@goldenqueen/bai (>=1.0.0, <=1.0.3), @khineeyouu/baileys (>=0.2.1, <=0.2.24) +10 more potentially affected by unknown CVE via @yaoii-bails/libsignall-node (0.0.1-security)

@yaoii-bails/libsignall-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @yaoii-bails/libsignall-node and may be impacted: - @goldenqueen/bai =1.0.0, =0.2.1, =2.0.16, =17.1.12, =1.0.13, =1.0.23, =1.0.24 - nopedorex 1.0.0 ...