@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +645 more potentially affected by CVE-2026-47676 via hono (>=4.0.0, <=4.12.19)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-47676 Source advisory: OSV:GHSA-2GCR-MFCQ-WCC3...

GHSA-WV26-88M5-6H59 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

31g-form-parser (1.0.107), @accounter/client (>=0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, <=0.0.12-alpha-20260508071110-20f5becdec9522d09c6a97f123f7c572407661fb) +379 more potentially affected by CVE-2026-42342 +1 more via react-router (>=7.0.0, <=7.14.2)

react-router NPM version =7.0.0, =0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2, =3.4.0, =2026.511.1, =0.2.3, =0.3.7 and more Source cves: CVE-2026-42342, CVE-2026-55685 Source advisory: OSV:GHSA-8X6R-G9MW-2R78...

Integer Underflow (Wrap or Wraparound)

Overview Affected versions of this package are vulnerable to Integer Underflow Wrap or Wraparound in the DecodeFromBytes function. An attacker can trigger a nil pointer dereference and panic by supplying a malicious BGP UPDATE message with a declared section length shorter than the actual data...

Fedora 44 : python-wsgidav (2026-b2212b4742)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b2212b4742 advisory. 4.3.4 / 2026-05-24 - Resolve security advisory CVE-2026-48099 Tenable has extracted the preceding description block directly from the Fedora security advisor...

Fedora 43 : perl-Catalyst-Plugin-Authentication (2026-af4f5feae8)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-af4f5feae8 advisory. Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks since these versions use Perl's built-in eq comparison...

@a1st/aix (>=0.0.3, <=0.6.0), @a1st/aix-core (>=0.2.0, <=0.6.0) +102 more potentially affected by CVE-2026-47428 via vitest (>=4.0.17, <=4.1.5)

vitest NPM version =4.0.17, =0.0.3, =0.2.0, =0.0.21, =0.79.1, =2.1.0-alpha.278, =2.1.0-alpha.281 and more Source cves: CVE-2026-47428 Source advisory: SNYK:JS-VITEST-17120487...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.249, <=2.1.0-alpha.251) +7 more potentially affected by CVE-2026-47429 via @vitest/browser (>=3.0.5, <=3.2.4)

@vitest/browser NPM version =3.0.5, =0.0.1, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =3.8.0, =1.0.1, =0.0.2, =0.0.5 Source cves: CVE-2026-47429 Source advisory: SNYK:JS-VITESTBROWSER-17120327...

Fedora 44 : perl-Crypt-PasswdMD5 (2026-30d86fe986)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-30d86fe986 advisory. This update uses a cryptographically strong random number source rather than perl's rand function to generate random salt values when required CVE-2026-6659...

CGA-8QV8-H5WX-9PF6

Bulletin has no description...

@agenticmail/cli (>=0.5.57, <=0.8.36), agenticmail (>=0.3.0, <=0.5.56) potentially affected by CVE-2026-47255 via @agenticmail/api (>=0.3.3, <=0.7.21)

@agenticmail/api NPM version =0.3.3, =0.5.57, =0.3.0, =0.5.56 Source cves: CVE-2026-47255 Source advisory: SNYK:JS-AGENTICMAILAPI-17739018...

123pancli (1.0.0), @abhinav-dev/mcp-platform-kit (1.0.0) +1062 more potentially affected by CVE-2026-42264 +1 more via axios (1.15.2)

axios NPM version 1.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on axios and may be impacted: - 123pancli 1.0.0 - @abhinav-dev/mcp-platform-kit 1.0.0 - @activepieces/piece-ai 0.4.4 - @activepieces/piece-amazon-bedrock 0.1.2 -...

Fedora 43 : rrdtool (2026-111ad9560f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-111ad9560f advisory. This is an update backporting some safety checks from the rrdtool-1.10.0. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 43 : xen (2026-7b2b7837b6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7b2b7837b6 advisory. x86: CPU Opcode Cache corruption XSA-490,CVE-2025-54518 Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

Amazon Linux 2 : libreoffice, --advisory ALAS2LIBREOFFICE-2026-008 (ALASLIBREOFFICE-2026-008)

The version of libreoffice installed on the remote host is prior to 5.3.6.1-21. It is, therefore, affected by a vulnerability as referenced in the ALAS2LIBREOFFICE-2026-008 advisory. NOTE: https://www.libreoffice.org/security/cve-2026-4430NOTE:...

@fedify/botkit (>=0.4.0-dev.184, <=0.5.0-dev.198), @fedify/botkit-sqlite (>=0.4.0-dev.184, <=0.5.0-dev.198) +1 more potentially affected by CVE-2026-42462 via @fedify/fedify (>=2.1.0, <=2.1.13)

@fedify/fedify NPM version =2.1.0, =0.4.0-dev.184, =0.4.0-dev.184, =2.1.0, =2.1.13 Source cves: CVE-2026-42462 Source advisory: OSV:GHSA-9RFG-V8G9-9367...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect in handling shiroSavedRequest cookies, which use unprotected/unencrypted values for SAVEDREQUESTKEY. An authenticated user can cause the server to make blind HTTP GET requests to arbitrary URLs or redirect users to untrust...

Fedora 44 : pie (2026-3d8d946f69)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3d8d946f69 advisory. Version 1.4.4 Dependencies - Update Composer to 2.9.8 ---- Version 1.4.3 - add output check for dnf permission denied thanks to @asgrim and @hackel - don't...

GHSA-58QX-3VCG-4XPX vulnerabilities

Vulnerabilities for packages: langfuse, vitess, opensearch-dashboards, kubeflow-pipelines, py3-jupyterlab, kubeflow-katib, code-server...

EUVD-2026-31429

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs...