io.spinnaker.kayenta:kayenta-atlas (main-309), io.spinnaker.kayenta:kayenta-aws (main-309) +65 more potentially affected by CVE-2026-44795 via io.spinnaker.orca:orca-core (main-309)

io.spinnaker.orca:orca-core MAVEN version main-309 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.orca:orca-core and may be impacted: - io.spinnaker.kayenta:kayenta-atlas main-309 - io.spinnaker.kayenta:kayenta-aws main-309 -...

org.openidentityplatform.openam:openam-fedlet-unconfigured-war (14.6.3), org.openidentityplatform.openig:openig-doc (5.0.11) +1 more potentially affected by CVE-2026-44793 via org.openidentityplatform.openam:openam-federation-library (14.6.3)

org.openidentityplatform.openam:openam-federation-library MAVEN version 14.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.openidentityplatform.openam:openam-federation-library and may be impacted: -...

Malicious code in node-fetch-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78aef0d64a7d761d2987d27aea462083425e5692475cd81332b7a3152c754308 On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host node22.lunes.host:3258, authenticates with a 5-minute rolling HMAC-SHA256 token,...

git-genie (0.1.0) potentially affected by CVE-2026-55443 via langchain (0.0.71)

langchain PYPI version 0.0.71 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - git-genie 0.1.0 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

docfusion (0.1.0), kgraphplanner (>=0.0.1, <=0.0.2) +7 more potentially affected by CVE-2026-55443 via langchain (0.2.12)

langchain PYPI version 0.2.12 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - docfusion 0.1.0 - kgraphplanner =0.0.1, =1.2.15, =0.2.2, =0.0.2, =0.0.10, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-55443 Source advisory:...

pyspark-ai (>=0.1.0, <=0.1.12), spark-llm (>=0.1.4, <=0.1.9) potentially affected by CVE-2026-55443 via langchain (0.0.201)

langchain PYPI version 0.0.201 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - pyspark-ai =0.1.0, =0.1.4, =0.1.9 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

jupyter-ai-magics (>=0.10.0, <=2.0.1), pykoi (>=0.0.4, <=0.0.6) potentially affected by CVE-2026-55443 via langchain (0.0.220)

langchain PYPI version 0.0.220 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - jupyter-ai-magics =0.10.0, =0.0.4, =0.0.6 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

vocode (>=0.1.51, <=0.1.98), xtracture (>=0.1.0, <=0.4.0) potentially affected by CVE-2026-55443 via langchain (0.0.117)

langchain PYPI version 0.0.117 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - vocode =0.1.51, =0.1.0, =0.4.0 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

langserve (0.0.1), llama-cpp-http (0.2.9) +2 more potentially affected by CVE-2026-55443 via langchain (0.0.304)

langchain PYPI version 0.0.304 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - langserve 0.0.1 - llama-cpp-http 0.2.9 - openbrain =0.13.0, =0.1.0, =0.2.13 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

agentic-kit-eda (0.0.2), agentic-kit-flow (0.0.1) +8 more potentially affected by CVE-2026-55443 via langchain (0.3.21)

langchain PYPI version 0.3.21 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - agentic-kit-eda 0.0.2 - agentic-kit-flow 0.0.1 - copilotkit =0.1.50, =0.2.0, =1.0.2, =0.1.0, =3.0.0, =0.1.0, =0.2.1 Source cves: CVE-2026-554...

agentuniverse (>=0.0.6.dev1, <=0.0.7), athina (>=0.1.5, <=0.1.6) +11 more potentially affected by CVE-2026-55443 via langchain (0.0.352)

langchain PYPI version 0.0.352 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - agentuniverse =0.0.6.dev1, =0.1.5, =0.0.8, =0.0.4, =0.0.8, =0.1.44, =0.0.1, =0.3.0, =0.1.3, =0.1.5 - nemoguardrails 0.6.1 -...

airbyte-destination-pgvector (>=0.1.0, <=0.1.4), akasha-terminal (>=0.8.29, <=0.8.68) +15 more potentially affected by CVE-2026-55443 via langchain (0.1.16)

langchain PYPI version 0.1.16 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - airbyte-destination-pgvector =0.1.0, =0.8.29, =0.1.0, =0.2.0, =0.0.18, =0.1.0, =0.2.5, =0.1.0, =0.5.0, =1.0.0, =1.0.1 - scraperai 0.0.2 and...

sayql (0.1.1) potentially affected by CVE-2026-55443 via langchain (0.0.179)

langchain PYPI version 0.0.179 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - sayql 0.1.1 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

gpt-index (>=0.5.17.post1, <=0.6.0a2), gpt3discord (>=11.3.0, <=11.6.2) potentially affected by CVE-2026-55443 via langchain (0.0.142)

langchain PYPI version 0.0.142 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - gpt-index =0.5.17.post1, =11.3.0, =11.6.2 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

simplerag (0.0.1) potentially affected by CVE-2026-55443 via langchain (0.0.165)

langchain PYPI version 0.0.165 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - simplerag 0.0.1 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

actscene-ocr (>=0.1.3, <=0.1.5), asap-cli (>=0.0.3, <=0.0.4.4) +44 more potentially affected by CVE-2026-55443 via langchain (0.3.27)

langchain PYPI version 0.3.27 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - actscene-ocr =0.1.3, =0.0.3, =0.3.1, =0.0.590, =0.1.3, =0.1.18, =0.1.7, =0.1.13.8, =0.0.2, =0.4.1, =0.4.3, =0.1.0, =0.2.3, =0.2.4 and more...

edubotics-core (>=0.1.3, <=0.1.7) potentially affected by CVE-2026-56104 via chainlit (1.2.0)

chainlit PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on chainlit and may be impacted: - edubotics-core =0.1.3, =0.1.7 Source cves: CVE-2026-56104 Source advisory: OSV:GHSA-C39V-8HRW-H448...

swarm-plus (>=0.0.0.1, <=0.1.0) potentially affected by CVE-2026-56104 via chainlit (1.3.1)

chainlit PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on chainlit and may be impacted: - swarm-plus =0.0.0.1, =0.1.0 Source cves: CVE-2026-56104 Source advisory: OSV:GHSA-C39V-8HRW-H448...

adversarial-friend (1.1.8), agrothon (>=1.1.5, <=1.3.2) +43 more potentially affected by CVE-2026-12479 via keras (2.4.3)

keras PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - adversarial-friend 1.1.8 - agrothon =1.1.5, =2.1.0, =0.0.6, =0.1.2.dev0, =0.1.0, =0.0.1.dev0, =0.0.6, =0.0.2, =0.1.3, =0.7.0, =1.4.0 and more Source...

deeppavlov (>=0.0.6b0, <=0.4.0) potentially affected by CVE-2026-12479 via keras (2.2.0)

keras PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - deeppavlov =0.0.6b0, =0.4.0 Source cves: CVE-2026-12479 Source advisory: OSV:GHSA-GH82-F9X8-5FRX...