adi (>=0.7.0, <=0.13.0-pre2), adi_gpu (>=0.7.0, <=0.11.0) +437 more potentially affected by unknown CVE via cgmath (>=0.1.5, <=0.18.0)

cgmath CARGO version =0.1.5, =0.7.0, =0.7.0, =0.8.0, =0.6.0, =0.5.3, =0.8.0, =0.1.0, =0.4.0, =0.2.0, =0.4.0, =0.5.0, =0.5.2, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0196...

@depup/electron-builder (26.8.1-depup.0), @lynx-js/lynxtron-builder (>=0.0.1-alpha.0, <=0.0.28) +8 more potentially affected by CVE-2026-54672 via app-builder-lib (>=26.0.0-alpha.0, <=26.14.0)

app-builder-lib NPM version =26.0.0-alpha.0, =0.0.1-alpha.0, =26.8.2-beta.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.14.0 Source cves: CVE-2026-54672 Source advisory: SNYK:JS-APPBUILDERLIB-17744441...

pycham (>=2.1.3, <=2.1.7) potentially affected by CVE-2026-2705 via openbabel (2.4.0)

openbabel PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on openbabel and may be impacted: - pycham =2.1.3, =2.1.7 Source cves: CVE-2026-2705 Source advisory: OSV:GHSA-4W5W-4FHM-Q483...

@bedrock/express (8.6.5), @cmmn/tools (>=3.0.0-alpha-1, <=3.0.0-alpha-6) +1 more potentially affected by CVE-2026-6556 via @fastify/express (>=4.0.1, <=4.0.5)

@fastify/express NPM version =4.0.1, =3.0.0-alpha-1, =3.0.0-alpha-6 - mikr0 0.1.10 Source cves: CVE-2026-6556 Source advisory: SNYK:JS-FASTIFYEXPRESS-17744444...

CVE-2026-13149

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

@activepieces/piece-google-gemini (0.1.6), @activepieces/piece-google-vertexai (0.1.2) +8 more potentially affected by CVE-2026-13149 via brace-expansion (>=2.0.0, <=2.0.2)

brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-13149 Source advisory: SNYK:JS-BRACEEXPANSION-17706650...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +28 more potentially affected by CVE-2026-13149 via brace-expansion (>=1.1.0, <=1.1.13)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.3, =0.1.0 and more Source cves: CVE-2026-13149 Source advisory: SNYK:JS-BRACEEXPANSION-17706650...

03-gs-ee-6 (0.3.5), @albgen/capacitor-escpos-plugin (>=0.0.4, <=1.0.1) +2934 more potentially affected by CVE-2026-13149 via brace-expansion (>=3.0.0, <=5.0.6)

brace-expansion NPM version =3.0.0, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 - @angranit/phantompirs 0.1.0 -...

org.apache.axis2:axis2-integration (1.4), org.apache.camel:camel-example-cxf (>=1.2.0, <=1.3.0) +3 more potentially affected by CVE-2026-49432 via org.apache.activemq:apache-activemq (>=4.1.1, <=5.0.0)

org.apache.activemq:apache-activemq MAVEN version =4.1.1, =1.2.0, =1.1.0, =1.3.0 - org.apache.camel:camel-example-spring 1.2.0 - org.apache.camel:camel-example-spring-xquery 1.3.0 Source cves: CVE-2026-49432 Source advisory: MEND:CVE-2026-49432...

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +1511 more potentially affected by CVE-2026-50734 via org.apache.activemq:activemq-client (>=5.8.0, <=5.19.7)

org.apache.activemq:activemq-client MAVEN version =5.8.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2026-50734 Source advisory: MEND:CVE-2026-50734...

be.yildiz-games:module-messaging-activemq (2.0.0), com.codbex.atlas:codbex-atlas-application (>=1.1.0, <=14.81.0) +120 more potentially affected by CVE-2026-54475 via org.apache.activemq:activemq-broker (>=6.0.0, <=6.2.6)

org.apache.activemq:activemq-broker MAVEN version =6.0.0, =1.1.0, =2.55.0, =1.0.5, =1.1.0, =1.1.0, =1.1.0, =0.2.0, =1.1.0, =5.0.0, =0.2.2, =1.4.0, =2.5.0 and more Source cves: CVE-2026-54475 Source advisory: MEND:CVE-2026-54475...

03-gs-ee-6 (0.3.5), @albgen/capacitor-escpos-plugin (>=0.0.4, <=1.0.1) +2934 more potentially affected by CVE-2026-13149 via brace-expansion (>=3.0.0, <=5.0.6)

brace-expansion NPM version =3.0.0, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 - @angranit/phantompirs 0.1.0 -...

annotald (>=1.3.1, <=1.3.7) potentially affected by CVE-2026-12243 via nltk (2.0.4)

nltk PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on nltk and may be impacted: - annotald =1.3.1, =1.3.7 Source cves: CVE-2026-12243 Source advisory: OSV:PYSEC-2026-597...

Malicious code in thirdwb (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. thirdwb is a typosquat of the legitimate thirdweb package. It uses a side-loader technique, pulling in log-taker as a transitive dependency; the infostealer runs automatically via that dependency's...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.31, <=9.0.118), org.apache.juddi:juddi-tomcat (>=3.3.6, <=3.3.10) +11 more potentially affected by CVE-2026-55276 via org.apache.tomcat:tomcat (>=9.0.10, <=9.0.118)

org.apache.tomcat:tomcat MAVEN version =9.0.10, =9.0.31, =3.3.6, =3.3.6, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =5.22.2, =8.0.0, =10.1.0 Source cves: CVE-2026-55276 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-17734714...

be.dabla:grizzly-spring-boot-jasper (>=2.0, <=2.7), co.cask.tephra:tephra-examples (>=0.6.2, <=0.7.1) +360 more potentially affected by CVE-2026-55276 via org.apache.tomcat:tomcat-util (>=9.0.0.m1, <=9.0.118)

org.apache.tomcat:tomcat-util MAVEN version =9.0.0.m1, =2.0, =0.6.2, =0.6.0, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =2.0.0, =5.9.6, =1.10, =1.10, =2.6.0, =2.8.0 - com.codedx:webapp-runner 9.0.65.0 - com.codedx:webapp-runner-main 9.0.65.0 - com.codedx:webapp-runner-memcached 9.0.65....

ch.qos.logback.access:logback-access-tomcat (>=2.0.7, <=2.0.15), codes.vps:tomcat-valve-request-filter (1.0) +161 more potentially affected by CVE-2026-55276 via org.apache.tomcat:tomcat-util (>=10.1.0-m1, <=10.1.55)

org.apache.tomcat:tomcat-util MAVEN version =10.1.0-m1, =2.0.7, =4.0.0, =5.0.0-m1, =5.0.0-m4, =1.0.0, =3.0.0, =5.0.0, =5.0.0, =3.3.0, =10.1.16.0, =10.1.16.0, =10.1.16.0, =10.1.55.0 and more Source cves: CVE-2026-55276 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-17734713...

@chargeover/strapi (0.0.1-rc1.1), @code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.4.3) +34 more potentially affected by CVE-2026-57997 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=5.42.1)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =0.1.1, =0.0.1, =0.1.0, =0.1.4 - cypherscan-strapi 0.1.1 - devlaunchers-strapiv4 0.1.0 - easylaser-vn-cms 0.1.0 - medusa-outerspace-plugin-strapi 1.0.0-beta.8 and more Source cves: CVE-2026-57997...

ch.qos.logback.access:logback-access-tomcat (>=2.0.7, <=2.0.15), codes.vps:tomcat-valve-request-filter (1.0) +117 more potentially affected by CVE-2026-55956 via org.apache.tomcat:tomcat-catalina (>=10.1.0, <=10.1.55)

org.apache.tomcat:tomcat-catalina MAVEN version =10.1.0, =2.0.7, =1.0.0, =5.0.0, =5.0.0, =3.3.0, =0.2.0, =20260429, =20260429, =2.8.0, =0.2.2, =0.2.4 and more Source cves: CVE-2026-55956 Source advisory: MEND:CVE-2026-55956...

com.navercorp.pinpoint:pinpoint-batch (>=2.3.0, <=3.1.0), com.navercorp.pinpoint:pinpoint-flink (>=2.3.0, <=3.0.5) +6 more potentially affected by CVE-2026-57948 via com.navercorp.pinpoint:pinpoint-web (>=2.3.0, <=3.1.0)

com.navercorp.pinpoint:pinpoint-web MAVEN version =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =3.0.0, =3.0.0, =2.5.0, =3.1.0 Source cves: CVE-2026-57948 Source advisory: SNYK:JAVA-COMNAVERCORPPINPOINT-17755931...