@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +24 more potentially affected by CVE-2026-75975 via fast-uri (>=3.0.1, <=3.1.5)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.4.2, =1.2.0, =5.4.3, =0.2.0-alpha.5, =0.1.0, =1.0.0, =1.0.0, =1.0.4 and more Source cves: CVE-2026-75975 Source advisory: OSV:GHSA-F65P-4M7J-42XC...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: sops, fulcio-fips, flux-source-controller, rekor, gitsign, flux-kustomize-controller, slsa-verifier, bank-vaults-fips, spire-server, aactl, falcoctl-fips, fulcio, spire-server-fips, cosign-fips, terragrunt, kubescape, cosign, vexctl, oauth2-proxy, dex,...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +55 more potentially affected by CVE-2026-71320 via nuxt (>=3.4.2, <=3.21.8)

nuxt NPM version =3.4.2, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =1.12.0-rc.7 and more Source cves: CVE-2026-71320 Source advisory: SNYK:JS-NUXT-18565115...

@cafeai/cafe-code (0.0.28), @echomem/mcp (>=1.4.2, <=1.4.34) +10 more potentially affected by CVE-2026-70606 via electron (>=41.0.3, <=41.7.1)

electron NPM version =41.0.3, =1.4.2, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70606 Source advisory: OSV:GHSA-R4W5-6PFG-JXP5...

@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70605 via electron (>=40.0.0, <=40.8.5)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70605 Source advisory: SNYK:JS-ELECTRON-18563326...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Linux Distros Unpatched Vulnerability : CVE-2026-62941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check...

@aaravpos/appointment-barber-booking (>=1.0.0, <=5.0.0), @aaravpos/appointment-booking-plugin (>=1.0.1, <=8.0.9) +256 more potentially affected by unknown CVE via react-router (>=7.12.0, <=7.18.1)

react-router NPM version =7.12.0, =1.0.0, =1.0.1, =0.0.9-alpha-20260107202750-16b04dcbaa92c7fc2bbb580dbc1da723c76a5225, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +969 more potentially affected by unknown CVE via tar (>=7.0.0, <=7.5.20)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: unknown CVE Source advisory: SNYK:JS-TAR-18319500...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +54 more potentially affected by CVE-2026-73419 via next-auth (>=4.0.0-beta.6, <=4.24.13)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: CVE-2026-73419 Source advisory: OSV:GHSA-X445-F3H2-J279...

@blumintinc/eslint-plugin-blumint (>=1.3.0, <=1.23.0), @eeacms/volto-cca-policy (>=0.1.17, <=1.0.32) +35 more potentially affected by CVE-2026-15699 via compromise (>=14.0.0, <=14.15.1)

compromise NPM version =14.0.0, =1.3.0, =0.1.17, =1.1.236, =0.1.1, =1.0.12, =4.0.2, =0.1.16, =0.1.14, =0.1.3, =0.1.29, =3.0.1, =0.1.0, =3.0.3, =0.1.4, =2.0.0-alpha.1, =2.2.0 and more Source cves: CVE-2026-15699 Source advisory: SNYK:JS-COMPROMISE-17972425...

@0xwork/connect (>=0.1.0, <=0.1.9), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +30 more potentially affected by CVE-2026-62188 via openclaw (>=2026.3.22, <=2026.6.6)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =1.1.50, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =2026.4.3-2 and more Source cves: CVE-2026-62188 Source advisory: SNYK:JS-OPENCLAW-17966765...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple packages which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor Component uses next-15.5.14.tgz, tomcat-embed-core-10.1.54.jar, systeminformation-5.31.4.tgz, jackson-core-2.19.2.jar, jackson-core-2.19.4.jar, jackson-core-2.20.0.jar, jackson-core-2.21.0.jar which are vulnerable to CVE-2026-44572, CVE-2026-44573,...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +21715 more potentially affected by CVE-2026-53486 via decompress (>=4.0.0, <=4.2.1)

decompress NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.0, =2.2.0-alpha.3 and more Source cves: CVE-2026-53486 Source advisory: OSV:GHSA-MP2F-45PM-3CG9...

Linux Distros Unpatched Vulnerability : CVE-2026-14383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HT...

Linux Distros Unpatched Vulnerability : CVE-2026-6092

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When HAVEENCRYPTTHENMAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC. CVE-2026-6092 Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-55958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsipStoreMessage the capacity check guarding the fixed message bag MSGBAGSIZE sets an erro...

Linux Distros Unpatched Vulnerability : CVE-2026-53179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix buffer over-read in rtwupdateprotection rtwupdateprotection is called with a pointer offset into the ies buffer but the full ielength is...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: go-discover, loki, caddy, prometheus, buildkitd, kubescape, k8sgpt, kyverno, flux-image-automation-controller, kots, flux-notification-controller, cluster-api-azure-controller, kine, crossplane-provider-azure-sql, step, step-kms-plugin, skaffold, rancher, nuclei,...