com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0 <=5.5.0), com.contentmunch:blog-api (>=2.0.0.RELEASE <=2.0.1.RELEASE) +136 more potentially affected by CVE-2026-41699 via org.springframework.graphql:spring-graphql (>=1.0.0 <=1.4.5)

org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =4.2.0, =2.0.0.RELEASE, =1.0.1, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0RC1 - com.graphql-java-generator:graphql-maven-plugin-samples-CustomTemplates-client =2.0RC1 -...

io.awspring.cloud:spring-cloud-aws-starter-integration-s3 (>=4.0.0 <=4.0.2), org.eclipse.dirigible:dirigible-components-engine-ftp (>=12.94.0 <=13.2.0) +18 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (>=7.0.0-M1 <=7.0.4)

org.springframework.integration:spring-integration-file MAVEN version =7.0.0-M1, =4.0.0, =12.94.0, =13.2.0 - org.springframework.cloud.fn:spring-aws-s3-common =6.0.0 - org.springframework.cloud.fn:spring-file-common =6.0.0 - org.springframework.cloud.fn:spring-file-consumer =6.0.0 -...

alvin-cli (>=0.0.1a0 <=1.3.0rc1), apache-airflow-providers-fastetl (>=0.0.36 <=0.0.39) +46 more potentially affected by CVE-2026-46374 via sqlfluff (>=0.11.2 <=4.1.0)

sqlfluff PYPI version =0.11.2, =0.0.1a0, =0.0.36, =0.4.6, =1.1.5, =0.1.2, =0.1.2, =0.2.0, =0.0.1, =0.1.0, =0.4.0, =0.19.1a7, =1.3.3, =0.9.3, =0.1.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-46374 Source advisory: OSV:PYSEC-2026-210...

0lever-utils (>=0.0.2 <=0.0.7), 0x-web3 (=5.0.0a5) +8036 more potentially affected by CVE-2026-34180 via cryptography (>=0.6.1 <=48.0.0)

cryptography PYPI version =0.6.1, =0.0.2, =0.5.3, =2.3.0, =0.1.0, =0.1.0, =0.5.0rc5, =0.9.2, =0.4.24, =0.1.0, =0.1.3, =0.0.1, =0.1.5, =0.1.1, =0.1.9 and more Source cves: CVE-2026-34180 Source advisory: SNYK:PYTHON-CRYPTOGRAPHY-17344551...

MAL-2026-5437 Malicious code in commons-ui-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b9fb701d18bde61d1dc783f0575a4d83bc0eba2653bd0832d0fc26bc9e85b48 [email protected] is an empty placeholder package index.js exports , description/author blank, version bumped to 99.9.1 — the classic...

Malicious code in commons-ui-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b9fb701d18bde61d1dc783f0575a4d83bc0eba2653bd0832d0fc26bc9e85b48 [email protected] is an empty placeholder package index.js exports , description/author blank, version bumped to 99.9.1 — the classic...

MAL-2026-5447 Malicious code in localization-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf143361939feffe7099c14acc7cf41a401681481e932e15d6054dde49e88f94 [email protected] is an empty shell package: index.js is module.exports = and package.json has no description or author. Its dependencies...

Malicious code in @sourceflow-uk/sourceflow-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5bcccc37c380ce54f5bfc2bc2311fbefb6ebc3400a397cbc4afc2188fb3c11d package.json declares a dependency ltidisafe whose version specifier is the raw URL https://storage.googleapis.com/lscunpentest/packuxfoundry.tgz — a...

MAL-2026-5430 Malicious code in @sourceflow-uk/sourceflow-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5bcccc37c380ce54f5bfc2bc2311fbefb6ebc3400a397cbc4afc2188fb3c11d package.json declares a dependency ltidisafe whose version specifier is the raw URL https://storage.googleapis.com/lscunpentest/packuxfoundry.tgz — a...

-tompan-reacttemplate (>=1.0.1 <=1.1.0), 0726react (=0.1.1) +28725 more potentially affected by CVE-2026-9277 via shell-quote (>=1.3.3 <=1.8.3)

shell-quote NPM version =1.3.3, =1.0.1, =1.1.0 - 0726react =0.1.1 - 0x0.icu.anima =0.1.0 - 0xcorde-pac =1.0.0 - 0xgank-tea-advice-pull =1.0.0 - 0xgank-tea-balance-pencil =1.0.0 - 0xgank-tea-brick-bell =1.0.0 - 0xgank-tea-cake-victory =1.0.0 - 0xgank-tea-central-compound =1.0.0 -...

awx-mcp-server (>=1.1.3 <=1.2.0), broker (>=0.0.0 <=0.6.12) +1 more potentially affected by CVE-2026-52902 via awxkit (>=23.9.0 <=24.6.1)

awxkit PYPI version =23.9.0, =1.1.3, =0.0.0, =1.5.0, =2.0.1 Source cves: CVE-2026-52902 Source advisory: SNYK:PYTHON-AWXKIT-17339772...

ai.langsa:ccaas-starter (>=cloud-0.1 <=cloud-0.3), ai.langsa:pom-ccaas-langsa (=0.1) +4409 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (>=6.0.0 <=6.5.10)

org.springframework.security:spring-security-web MAVEN version =6.0.0, =cloud-0.1, =1.0.0-20260516144515, =1.0.0-20260516144515, =1.0.0-20260516144515, =1.0.0-20260516144515, =1.0.0-20260516144515, =1.0.0-20260516144515, =1.0.0-20260516144515, =1.0.0-20260516144515, =0.5.2, =0.5.0, =0.5.1 -...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0-20260516144515 <=1.0.0.ee-20260528111216), com.eurodyn.qlack.fuse:qlack-fuse-aaa (>=3.9.8 <=3.9.9) +109 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=6.2.0 <=6.5.10)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.2.0, =1.0.0-20260516144515, =3.9.8, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =12.2, =15.1.1, =12.2, =12.2, =15.1.1, =15.1.2 and more Source cves:...

com.erudika:para-server (>=1.52.0 <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1 <=2.0.4) +3 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0-M1 <=7.0.5)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0-M1, =1.52.0, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.6 Source cves: CVE-2026-41694 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKSECURITY-17307750...

ai.langsa:ccaas-starter (>=cloud-0.1 <=cloud-0.3), ai.langsa:pom-ccaas-langsa (=0.1) +3436 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-config (>=6.0.0 <=6.5.10)

org.springframework.security:spring-security-config MAVEN version =6.0.0, =cloud-0.1, =1.0.0-20260516144515, =1.0.0-20260516144515, =1.0.0-20260516144515, =1.0.0-20260516144515, =1.0.0-20260516144515, =1.0.0-20260516144515, =1.0.0-20260516144515, =1.0.0-20260516144515, =0.5.0, =0.0.1, =0.0.2 and...

ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +2346 more potentially affected by CVE-2026-47691 via io.netty:netty-resolver-dns (>=4.2.0.Final <=4.2.14.Final)

io.netty:netty-resolver-dns MAVEN version =4.2.0.Final, =0.1.0, =0.1.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.2 and more Source cves: CVE-2026-47691 Source advisory: SNYK:JAVA-IONETTY-17261020...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1 <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +14426 more potentially affected by CVE-2026-47691 via io.netty:netty-resolver-dns (>=4.1.0.Beta7 <=4.1.134.Final)

io.netty:netty-resolver-dns MAVEN version =4.1.0.Beta7, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.28.0 and more Source cves: CVE-2026-47691 Sour...

ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +3026 more potentially affected by CVE-2026-47244 via io.netty:netty-codec-http2 (>=4.2.0.Final <=4.2.14.Final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.Final, =0.1.0, =0.1.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.2 and more Source cves: CVE-2026-47244 Source advisory: OSV:GHSA-5X3R-WRVG-RP6Q...

ai.spice:spiceai (=0.6.0), cn.isqing.icloud:icloud-common-utils (>=4.0.3-M1 <=4.0.3.1) +431 more potentially affected by CVE-2026-46340 via io.netty:netty-transport-sctp (>=4.2.0.Final <=4.2.14.Final)

io.netty:netty-transport-sctp MAVEN version =4.2.0.Final, =4.0.3-M1, =1.21.9, =3.4.7, =25.4.1, =26.2.1, =7.9.0, =5.1.0, =5.1.0, =6.80, =0.2.2, =0.2.4 and more Source cves: CVE-2026-46340 Source advisory: SNYK:JAVA-IONETTY-17265741...

ai.spice:spiceai (=0.6.0), cn.isqing.icloud:icloud-common-utils (>=4.0.3-M1 <=4.0.3.1) +431 more potentially affected by CVE-2026-46340 via io.netty:netty-transport-sctp (>=4.2.0.Final <=4.2.14.Final)

io.netty:netty-transport-sctp MAVEN version =4.2.0.Final, =4.0.3-M1, =1.21.9, =3.4.7, =25.4.1, =26.2.1, =7.9.0, =5.1.0, =5.1.0, =6.80, =0.2.2, =0.2.4 and more Source cves: CVE-2026-46340 Source advisory: OSV:GHSA-5XRH-QMMQ-W6CH...