@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +26 more potentially affected by CVE-2026-75975 via fast-uri (>=3.0.1, <=3.1.5)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =5.4.3, =0.2.0-alpha.5, =0.1.0, =1.0.0, =1.0.3 and more Source cves: CVE-2026-75975 Source advisory: OSV:GHSA-F65P-4M7J-42XC...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: oauth2-proxy, spire-server-fips, timestamp-authority-fips, falcoctl-fips, vexctl, fulcio-fips, tekton-chains, kubescape, slsa-verifier, terragrunt, argo-workflows, aactl, gitsign, rekor, cosign-fips, dex, flux-source-controller, cosign, tkn, kots, bank-vaults-fips,...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +55 more potentially affected by CVE-2026-71320 via nuxt (>=3.4.2, <=3.21.8)

nuxt NPM version =3.4.2, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =1.12.0-rc.7 and more Source cves: CVE-2026-71320 Source advisory: SNYK:JS-NUXT-18565115...

@cafeai/cafe-code (0.0.28), @echomem/mcp (>=1.4.2, <=1.4.34) +10 more potentially affected by CVE-2026-70606 via electron (>=41.0.3, <=41.7.1)

electron NPM version =41.0.3, =1.4.2, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70606 Source advisory: OSV:GHSA-R4W5-6PFG-JXP5...

@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70605 via electron (>=40.0.0, <=40.8.5)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =40.1.0, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70605 Source advisory: SNYK:JS-ELECTRON-18563326...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Linux Distros Unpatched Vulnerability : CVE-2026-62941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check...

@aaravpos/appointment-barber-booking (>=1.0.0, <=5.0.0), @aaravpos/appointment-booking-plugin (>=1.0.1, <=8.0.9) +258 more potentially affected by unknown CVE via react-router (>=7.12.0, <=7.18.1)

react-router NPM version =7.12.0, =1.0.0, =1.0.1, =1.0.0, =0.0.9-alpha-20260107202750-16b04dcbaa92c7fc2bbb580dbc1da723c76a5225, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source cves: unknown CV...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +976 more potentially affected by unknown CVE via tar (>=7.0.0, <=7.5.20)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: unknown CVE Source advisory: SNYK:JS-TAR-18319500...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +54 more potentially affected by CVE-2026-73419 via next-auth (>=4.0.0-beta.6, <=4.24.13)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: CVE-2026-73419 Source advisory: OSV:GHSA-X445-F3H2-J279...

@blumintinc/eslint-plugin-blumint (>=1.3.0, <=1.23.0), @eeacms/volto-cca-policy (>=0.1.17, <=1.0.46) +35 more potentially affected by CVE-2026-15699 via compromise (>=14.0.0, <=14.15.1)

compromise NPM version =14.0.0, =1.3.0, =0.1.17, =1.1.236, =0.1.1, =1.0.12, =4.0.2, =0.1.16, =0.1.14, =0.1.3, =0.1.29, =3.0.1, =0.1.0, =3.0.3, =0.1.4, =2.0.0-alpha.1, =2.2.0 and more Source cves: CVE-2026-15699 Source advisory: SNYK:JS-COMPROMISE-17972425...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple packages which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor Component uses next-15.5.14.tgz, tomcat-embed-core-10.1.54.jar, systeminformation-5.31.4.tgz, jackson-core-2.19.2.jar, jackson-core-2.19.4.jar, jackson-core-2.20.0.jar, jackson-core-2.21.0.jar which are vulnerable to CVE-2026-44572, CVE-2026-44573,...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +21720 more potentially affected by CVE-2026-53486 via decompress (>=4.0.0, <=4.2.1)

decompress NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.0, =2.2.0-alpha.3 and more Source cves: CVE-2026-53486 Source advisory: OSV:GHSA-MP2F-45PM-3CG9...

Linux Distros Unpatched Vulnerability : CVE-2026-14383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HT...

Linux Distros Unpatched Vulnerability : CVE-2026-55958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsipStoreMessage the capacity check guarding the fixed message bag MSGBAGSIZE sets an erro...

Linux Distros Unpatched Vulnerability : CVE-2026-6092

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When HAVEENCRYPTTHENMAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC. CVE-2026-6092 Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-53179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix buffer over-read in rtwupdateprotection rtwupdateprotection is called with a pointer offset into the ies buffer but the full ielength is...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: eksctl, rancher-machine, skaffold, splunk-otel-collector, crossplane-provider-azure-sql, nerdctl, falcoctl, docker-cli-buildx, dagger, kine, opentelemetry-collector, wal-g, pulumi, tekton-chains, slsa-verifier, ksops, buildah, argo-cd, minio, flux-source-controller,...

@3ngram/server (0.7.0), @compeso/node-red-contrib-imap-email (1.0.0) +8 more potentially affected by CVE-2026-82659 via nodemailer (9.0.0)

nodemailer NPM version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nodemailer and may be impacted: - @3ngram/server 0.7.0 - @compeso/node-red-contrib-imap-email 1.0.0 - @hybridaione/hybridclaw =0.25.3, =2.71.0, =2.72.0 - imapflow 1.4.1 -...