128autograder-ipython (1.0.0rc2), 3-04-2025-ttm (0.1.0) +6324 more potentially affected by CVE-2026-6658 via nbconvert (>=4.2.0, <=7.17.1)

nbconvert PYPI version =4.2.0, =0.5.0a0, =0.1.0, =1.0.3, =0.1.8, =0.1.0, =0.0.0, =1.0.0, =0.11.0, =0.11.2 and more Source cves: CVE-2026-6658 Source advisory: SNYK:PYTHON-NBCONVERT-17707798...

aide-infra (>=0.2.2a0, <=0.3.9), aide-sdk (>=1.0.0b4, <=1.0.6) +56 more potentially affected by CVE-2026-56445 via pynetdicom (>=1.4.1, <=3.0.4)

pynetdicom PYPI version =1.4.1, =0.2.2a0, =1.0.0b4, =2020.12.2, =0.1.0, =0.1.0, =0.0.8, =0.0.1, =0.2.3, =0.5.3 and more Source cves: CVE-2026-56445 Source advisory: SNYK:PYTHON-PYNETDICOM-17816663...

a3s-cron (0.1.2), a3s-lane (>=0.2.0, <=0.4.0) +172 more potentially affected by CVE-2026-48504 via opentelemetry_sdk (>=0.18.0, <=0.31.0)

opentelemetrysdk CARGO version =0.18.0, =0.2.0, =0.14.0, =0.1.0, =0.0.1, =0.8.1, =0.3.0, =4.0.15, =0.1.0, =0.1.0, =0.1.0, =0.1.5 and more Source cves: CVE-2026-48504 Source advisory: OSV:GHSA-W9WP-H8WV-79JX...

@browserbasehq/director-ai (1.0.2), @license-cop/core (>=2.0.0, <=2.1.1) +43 more potentially affected by CVE-2026-50021 via @pnpm/lockfile.utils (>=1004.0.0, <=1004.0.3)

@pnpm/lockfile.utils NPM version =1004.0.0, =2.0.0, =1002.0.21, =1007.0.1, =1003.0.0, =1002.3.8, =1003.0.25, =1002.0.4, =1001.2.0, =1001.0.35, =1000.2.4, =1001.0.30, =1001.0.28, =1001.1.28, =1000.0.29, =1000.0.32 and more Source cves: CVE-2026-50021 Source advisory:...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-50021 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-50021 Source advisory: SNYK:JS-PNPM-17661056...

CVE-2026-50016

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can...

@diia-inhouse/i18n (>=2.8.2, <=3.1.16), @genie23/electron-base (>=0.0.4-alpha, <=0.0.225) +56 more potentially affected by CVE-2026-48713 via i18next-fs-backend (>=2.0.0, <=2.6.5)

i18next-fs-backend NPM version =2.0.0, =2.8.2, =0.0.4-alpha, =3.0.0-rc.0, =7.1.2, =2.4.2, =1.1.8, =1.1.8, =2.4.2, =2.4.2, =2.6.9, =2.4.2, =2.4.2, =2.4.2, =2.4.2, =2.5.5 and more Source cves: CVE-2026-48713 Source advisory: OSV:GHSA-2933-Q333-QG83...

@ainsleydev/payload-helper (>=0.0.1, <=0.0.2), @bsct/payload (1.0.0) +89 more potentially affected by CVE-2026-48714 via i18next-http-middleware (>=3.0.2, <=3.9.6)

i18next-http-middleware NPM version =3.0.2, =0.0.1, =1.0.1, =0.0.1, =0.0.1, =0.0.1, =8.0.0-alpha1, =3.0.0-rc.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.3 and more Source cves: CVE-2026-48714 Source advisory: OSV:GHSA-F49M-VF83-692W...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-55180 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-55180 Source advisory: SNYK:JS-PNPM-17874446...

CVE-2026-50016 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can...

CVE-2026-50016

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can...

CVE-2026-50016

pnpm (the package manager) is affected by CVE-2026-50016. Before versions 10.34.0 and 11.4.0, a transitive dependency alias from registry metadata could include path traversal segments. During install, pnpm may treat that alias as a filesystem path when linking dependency nodes, allowing a regist...

CVE-2026-50016 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can...

CVE-2026-50016 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can...

@applydigital/claude (>=1.0.0, <=1.2.1), @bsklaroff/yaac (>=0.0.1, <=0.0.6) +12 more potentially affected by CVE-2026-46406 via @anthropic-ai/claude-code (>=2.1.63, <=2.1.117)

@anthropic-ai/claude-code NPM version =2.1.63, =1.0.0, =0.0.1, =0.7.5, =0.6.1-beta.1, =1.83.1, =0.8.1, =0.8.0, =1.0.33, =1.0.0-dev.1, =2.1.99, =1.2.2, =1.2.3 Source cves: CVE-2026-46406 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-17660545...

@applydigital/claude (>=1.0.0, <=1.2.1), @bsklaroff/yaac (>=0.0.1, <=0.0.6) +12 more potentially affected by CVE-2026-46406 via @anthropic-ai/claude-code (>=2.1.63, <=2.1.117)

@anthropic-ai/claude-code NPM version =2.1.63, =1.0.0, =0.0.1, =0.7.5, =0.6.1-beta.1, =1.83.1, =0.8.1, =0.8.0, =1.0.33, =1.0.0-dev.1, =2.1.99, =1.2.2, =1.2.3 Source cves: CVE-2026-46406 Source advisory: OSV:GHSA-4VP2-6Q8C-PVQ2...

@antfu/nip (0.1.1), @condu-feature/auto-package-exports (>=1.0.0, <=1.0.3) +90 more potentially affected by CVE-2026-55697 via @pnpm/config (>=1004.0.0, <=1004.11.2)

@pnpm/config NPM version =1004.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.2, =26.2.0, =1.0.6, =0.6.19, =0.1.0-beta.0, =0.3.1 - @mirta/rollup 0.3.5 and more Source cves: CVE-2026-55697 Source advisory: SNYK:JS-PNPMCONFIG-17875561...

abe (0.3.0-rc1), annembed (>=0.0.3, <=0.0.7) +80 more potentially affected by unknown CVE via anyhow (>=1.0.13, <=1.0.102)

anyhow CARGO version =1.0.13, =0.0.3, =0.0.5, =0.1.4, =0.5.0, =0.1.15, =0.2.1, =0.2.0, =0.2.0, =0.2.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0190...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0726react (0.1.1) +28144 more potentially affected by CVE-2026-13311 via shell-quote (>=1.3.3, <=1.8.4)

shell-quote NPM version =1.3.3, =1.0.1, =1.1.0 - 0726react 0.1.1 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 -...

Fortress and Gatekeeper: Theorizing Transitive Trust in Third-Party Cybersecurity Risk Governance

Third-party vendors, such as analytics platforms, cloud services, identity providers, and software suppliers, are increasingly embedded in digital service delivery. While these arrangements enable scale and specialization, they also move customer data and security-relevant practices into...