CVE-2026-105743: Time-of-check Time-of-use (TOCTOU) Race Condition

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validateurlsafety in docling/backend/utils/imageresourceloader.py validates a hostname with a single IPv4 lookup and then allows the HTTP clien...

CVE-2026-104852: Improperly Controlled Modification of Object Prototype Attributes

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

GPAC multimedia platform Heap Buffer Overflow DoS

The vulnerability of the src/utils/baseencoding.c file in the ISOBMFF component parser of the GPAC multimedia platform is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause service failures...

Malicious code in rgx33-css-grid-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 320488b79c9000782e398425aa1a2fddba7f29a487913bbb2fc2019405c078f5 The package is published as rgx33-css-grid-utils but exports a set of module keys matching Wix thunderbolt internal registries thunderboltRegistry,...

MAL-2026-17520 Malicious code in rgx33-css-grid-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 320488b79c9000782e398425aa1a2fddba7f29a487913bbb2fc2019405c078f5 The package is published as rgx33-css-grid-utils but exports a set of module keys matching Wix thunderbolt internal registries thunderboltRegistry,...

Malicious code in css-a11y-contrast-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ad65ab7d49c4277898f5da5b5d45f3ec9cde46035bcf6416e3a95507ca1301 [email protected] is advertised as a WCAG contrast utility but ships no contrast code — index.js exports an empty object. The package...

MAL-2026-17475 Malicious code in css-a11y-contrast-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ad65ab7d49c4277898f5da5b5d45f3ec9cde46035bcf6416e3a95507ca1301 [email protected] is advertised as a WCAG contrast utility but ships no contrast code — index.js exports an empty object. The package...

[SECURITY] Fedora 45 Update: nfs-utils-2.9.2-1.rc1.fc45.1

The nfs-utils package provides a daemon for the kernel NFS server and related tools, which provides a much higher level of performance than the traditional Linux NFS server used by most users...

[SECURITY] Fedora 45 Update: gnome-doc-utils-0.20.10-48.fc45

gnome-doc-utils is a collection of documentation utilities for the GNOME project. Notably, it contains utilities for building documentation and all auxiliary files in your source tree...

[SECURITY] Fedora 45 Update: gnome-chemistry-utils-0.14.17-57.fc45

This is a meta-package for applications in the GNOME Chemistry Utils suite: A 3D molecular structure viewer GChem3D. A Chemical calculator GChemCalc. A 2D structure editor GChemPaint. A periodic table of the elements application GChemTable. A crystalline structure editor GCrystal. A spectra viewe...

[SECURITY] Fedora 45 Update: erofs-utils-1.9.4-2.fc45

EROFS stands for Enhanced Read-Only File System. It aims to be a general read-only file system solution for various use cases instead of just focusing on saving storage space without considering runtime performance. This package includes tools to create, check, and extract EROFS images...

Directory Traversal

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Directory Traversal via readNxMigrateConfig in packages/nx/src/utils/package-json.ts, which returned the...

Directory Traversal

Overview org.webjars.npm:nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Directory Traversal via readNxMigrateConfig in packages/nx/src/utils/package-json.ts, which...

Malicious Package

Overview @bluewin/utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in @bluewin/utils (npm)

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...

CVE-2026-97688 vulnerabilities

Vulnerabilities for packages: confluent-docker-utils, datadog-agent, kubeflow-pipelines-visualization-server, py3-pip, py3-pipenv, py3-cassandra-medusa, kubeflow-pipelines, open-webui, kserve, superset, jwt-tool, pypy-3.10...

GHSA-8988-9CW3-XX77 vulnerabilities

Vulnerabilities for packages: confluent-docker-utils, datadog-agent, kubeflow-pipelines-visualization-server, py3-pip, py3-pipenv, py3-cassandra-medusa, kubeflow-pipelines, open-webui, kserve, superset, jwt-tool, pypy-3.10...

GHSA-GH4C-6FX4-QH6G vulnerabilities

Vulnerabilities for packages: confluent-docker-utils, datadog-agent, kubeflow-pipelines-visualization-server, py3-pip, py3-pipenv, py3-cassandra-medusa, kubeflow-pipelines, open-webui, kserve, superset, jwt-tool, pypy-3.10...

CVE-2026-97687 vulnerabilities

Vulnerabilities for packages: confluent-docker-utils, datadog-agent, kubeflow-pipelines-visualization-server, py3-pip, py3-pipenv, py3-cassandra-medusa, kubeflow-pipelines, open-webui, kserve, superset, jwt-tool, pypy-3.10...

cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +5 more potentially affected by CVE-2026-102831 via jupyterlab (>=4.6.0, <=4.6.2)

jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-102831 Source advisory: OSV:PYSEC-2026-4057...