See the full list of npm packages affected by the "Mastra Supply Chain Compromise - June 2026" [View compromised packages].
Find out if you have vulnerabilities that put you at risk
Test your applicationsAPPLICATION
OPERATING SYSTEM
- M
Incomplete List of Disallowed InputsCVE-2026-41206
Affects pyspector | Versions [,0.1.8)
Has fix
pipPublished 30 Apr 2026
- M
Cross-site Scripting (XSS)CVE-2026-41241
Affects pretalx | Versions [,2026.1.0)
Has fix
pipPublished 30 Apr 2026
- C
Embedded Malicious CodeCVE-2026-44484
Affects lightning | Versions [2.6.2][2.6.3]
Has fix
pipPublished 30 Apr 2026
Affects giskard-checks | Versions [,1.0.2b1)
Has fix
pipPublished 30 Apr 2026
- L
Regular Expression Denial of Service (ReDoS)CVE-2026-40319
Affects giskard-checks | Versions [,1.0.2b1)
Has fix
pipPublished 30 Apr 2026
- M
SQL InjectionCVE-2025-66335
Affects doris-mcp-server | Versions [,0.6.1)
Has fix
pipPublished 30 Apr 2026
- H
Improper Certificate ValidationCVE-2026-41132
Affects ckan | Versions [,2.10.10)[2.11.0,2.11.5)
Has fix
pipPublished 30 Apr 2026
- H
SQL InjectionCVE-2026-42031
Affects ckan | Versions [,2.10.10)[2.11.0, 2.11.5)
Has fix
pipPublished 30 Apr 2026
- M
Cross-site Request Forgery (CSRF)CVE-2026-41255
Affects ckan | Versions [, 2.10.10)[2.11.0, 2.11.5)
Has fix
pipPublished 30 Apr 2026
- H
Arbitrary Code InjectionCVE-2026-40156
Affects praisonai | Versions [,4.5.140)
Has fix
pipPublished 30 Apr 2026
- M
Cross-site Request Forgery (CSRF)CVE-2026-40948
Affects apache-airflow-providers-keycloak | Versions [,0.7.0rc1)
Has fix
pipPublished 30 Apr 2026
- M
Use of Uninitialized ResourceCVE-2026-7141
Affects vllm | Versions [0,]
Has fix
pipPublished 29 Apr 2026
- C
Authorization Bypass Through User-Controlled KeyCVE-2026-24178
Affects nvflare | Versions [,2.7.2)
Has fix
pipPublished 29 Apr 2026
- H
Deserialization of Untrusted DataCVE-2026-24186
Affects nvflare | Versions [,2.7.2)
Has fix
pipPublished 29 Apr 2026
- H
Improper Input ValidationCVE-2026-24204
Affects nvflare | Versions [,2.7.2)
Has fix
pipPublished 29 Apr 2026
- H
Directory TraversalCVE-2026-39847
Affects emmett | Versions [2.5.0,2.8.1)
Has fix
pipPublished 28 Apr 2026
- H
Permissive Cross-domain Policy with Untrusted DomainsCVE-2026-34839
Affects glances | Versions [,4.5.4)
Has fix
pipPublished 28 Apr 2026
- H
Server-side Request Forgery (SSRF)CVE-2026-35587
Affects glances | Versions [,4.5.4)
Has fix
pipPublished 28 Apr 2026
- M
Server-side Request Forgery (SSRF)CVE-2026-6111
Affects metagpt | Versions [0,]
Has fix
pipPublished 28 Apr 2026
- M
Cross-site Request Forgery (CSRF)CVE-2026-6109
Affects metagpt | Versions [0,]
Has fix
pipPublished 28 Apr 2026
- M
Arbitrary Code InjectionCVE-2026-5971
Affects metagpt | Versions [0,]
Has fix
pipPublished 28 Apr 2026
- M
Arbitrary Command InjectionCVE-2026-5972
Affects metagpt | Versions [0,]
Has fix
pipPublished 28 Apr 2026
- M
Arbitrary Command InjectionCVE-2026-5974
Affects metagpt | Versions [0,]
Has fix
pipPublished 28 Apr 2026
- M
Arbitrary Command InjectionCVE-2026-5973
Affects metagpt | Versions [0,]
Has fix
pipPublished 28 Apr 2026
- C
Not Failing Securely ('Failing Open')CVE-2026-40525
Affects openviking | Versions [,0.3.9)
Has fix
pipPublished 28 Apr 2026
- H
SQL InjectionCVE-2026-41496
Affects praisonai | Versions [,4.5.149)
Has fix
pipPublished 28 Apr 2026
- H
SQL InjectionCVE-2026-41496
Affects praisonaiagents | Versions [,1.6.9)
Has fix
pipPublished 28 Apr 2026