@aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.6), @aaravpos/appointment-booking-plugin (>=1.0.1, <=8.0.2) +274 more potentially affected by unknown CVE via react-router (>=7.12.0, <=7.18.1)

react-router NPM version =7.12.0, =1.0.0, =1.0.1, =0.0.9-alpha-20260107202750-16b04dcbaa92c7fc2bbb580dbc1da723c76a5225, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source...

@appigram/react-code-split-ssr (>=2.1.0, <=2.1.2), @ariestools/sdk-react-crypto (>=11.1.1, <=11.1.5) +35 more potentially affected by unknown CVE via react-router (>=8.0.0-pre.1, <=8.2.0)

react-router NPM version =8.0.0-pre.1, =2.1.0, =11.1.1, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0, =3.4.0-ultramodern.0,...

@104corp/cdk-aws-codedeploy-on-premises (>=1.0.0, <=1.0.2), @abletest/able (>=0.0.1, <=0.0.4) +274 more potentially affected by unknown CVE via @aws-cdk/aws-codebuild (>=1.75.0, <=1.204.0)

@aws-cdk/aws-codebuild NPM version =1.75.0, =1.0.0, =0.0.1, =0.1.0, =1.0.6, =1.0.0, =1.1.0-GqlExtensibility.1, =1.2.0-geo.0, =0.0.1, =4.13.3-beta.0, =7.6.26-npm-pkg-cli.0, =7.6.27-alpha.5030, =1.1.0-ext1.0, =1.75.0, =1.0.0, =1.204.0 and more Source cves: unknown CVE Source advisory:...

@fastify/static vulnerable to route guard bypass via path traversal

Impact @fastify/static is vulnerable to a bypass of route-based middleware and guards via non-leading .. and %2E%2E path segments. find-my-way does not normalize .. when matching routes, so a request such as /foo/../deep/secret.txt matches the static plugin's catch-all instead of the guarded...

CVE-2026-54673

creationtimestamp| type| source ---|---|--- 2026-07-24 16:35:24+00:00| published-proof-of-concept| https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797...

CVE-2026-63632

creationtimestamp| type| source ---|---|--- 2026-07-24 16:35:09+00:00| published-proof-of-concept| https://github.com/onnx/onnx/security/advisories/GHSA-p893-rvq9-2xf9...

@a-la-fois/api (>=0.0.25, <=0.0.39), @a-la-fois/doc-client (>=0.0.1-alpha.89, <=0.0.39) +116 more potentially affected by CVE-2026-73562 via mongoose (>=7.0.0, <=7.8.8)

mongoose NPM version =7.0.0, =0.0.25, =0.0.1-alpha.89, =0.0.25, =0.0.1, =0.0.25, =3.12.0, =1.0.0, =1.0.6-beta.0, =0.2.0-alpha.1, =0.2.0-alpha.0, =0.0.0, =1.0.2, =1.0.0, =7.6.10, =7.8.6 and more Source cves: CVE-2026-73562 Source advisory: OSV:GHSA-664H-WQGQ-64GW...

123ts-backend-setup-prod (1.0.0), 4casterschemas (>=1.0.0, <=1.0.1) +199 more potentially affected by CVE-2026-73562 via mongoose (>=8.0.0, <=8.24.0)

mongoose NPM version =8.0.0, =1.0.0, =2.1.5, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =3.13.0, =3.17.2 - @albertoielpo/kk-cli 1.0.7 and more Source cves: CVE-2026-73562 Source advisory: OSV:GHSA-664H-WQGQ-64GW...

@akemona-org/strapi-connector-mongoose (>=3.18.2, <=3.19.3), @albertoielpo/kk-cli (>=1.1.0, <=1.1.2) +30 more potentially affected by CVE-2026-73562 via mongoose (>=9.0.0, <=9.7.1)

mongoose NPM version =9.0.0, =3.18.2, =1.1.0, =1.0.0, =12.3.0, =11.0.36, =8.2.3, =0.2.29, =0.0.1, =11.7.0, =4.0.0, =2.0.0, =2.0.0, =0.4.1, =0.1.24, =0.7.0, =0.11.0 and more Source cves: CVE-2026-73562 Source advisory: OSV:GHSA-664H-WQGQ-64GW...

@3kles/3kles-coremongodb (>=1.2.3, <=1.3.1), @3kles/storagebox-common (1.0.3) +419 more potentially affected by unknown CVE via mongoose (>=6.0.1, <=6.13.9)

mongoose NPM version =6.0.1, =1.2.3, =2.0.1, =0.0.1-alpha.89, =0.0.1-alpha.89, =0.0.3, =1.0.5, =3.9.0, =1.0.9, =1.0.0-beta1, =1.4.5, =1.1.80, =0.0.1, =0.1.16 and more Source cves: unknown CVE Source advisory: SNYK:JS-MONGOOSE-18319533...

@claspo/common (>=5.2.1-theme.13, <=7.5.2), @claspo/components (>=1.1.14, <=1.10.16) +3 more potentially affected by unknown CVE via velocityjs (>=2.0.6, <=2.1.6)

velocityjs NPM version =2.0.6, =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.6.0 Source cves: unknown CVE Source advisory: SNYK:JS-VELOCITYJS-18319515...

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

Summary Remote Code Execution RCE in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq "Prototype Pollution in set path assignment" — that advisory blocked constructor/proto/prototype only in the set assignment handler set.cjs, but...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.17-next.0) +12 more potentially affected by unknown CVE via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.29.1-next.0)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748,...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the JNX decoder. An attacker can cause a heap buffer over-write by processing extremely large files on 32-bit builds. Remediation A fix was pushed into the master branch but not yet published. Reference...

@burger-editor/blocks (>=4.0.0-alpha.1, <=4.0.0-alpha.7), @burger-editor/client (>=4.0.0-alpha.1, <=4.0.0-alpha.7) +4 more potentially affected by unknown CVE via trix (>=2.0.8, <=2.1.15)

trix NPM version =2.0.8, =4.0.0-alpha.1, =4.0.0-alpha.1, =4.0.0-alpha.1, =4.0.0-alpha.5, =4.0.0-alpha.1, =1.0.1, =1.0.3 Source cves: unknown CVE Source advisory: SNYK:JS-TRIX-18307297...

@alexaegis/svelte-config (>=0.9.2, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +19 more potentially affected by CVE-2026-82257 via @sveltejs/kit (>=2.0.0, <=2.65.1)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =10.0.1, =0.1.0, =0.0.1-alpha.26, =2.0.0, =0.4.1, =5.0.0-alpha.1, =0.0.1, =0.1.0, =0.2.0 and more Source cves: CVE-2026-82257 Source advisory: OSV:GHSA-866W-XMHQ-WJ7X...

@openinc/parse-server-opendash (>=4.0.0, <=4.1.2) potentially affected by CVE-2026-66009 via parse-server (>=9.6.0-alpha.37, <=9.9.1-alpha.13)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.1.2 Source cves: CVE-2026-66009 Source advisory: SNYK:JS-PARSESERVER-18306805...

@openinc/parse-server-opendash (>=4.0.0, <=4.1.2) potentially affected by CVE-2026-66008 via parse-server (>=9.6.0-alpha.37, <=9.9.1-alpha.13)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.1.2 Source cves: CVE-2026-66008 Source advisory: SNYK:JS-PARSESERVER-18306804...

@alexaegis/svelte-config (>=0.9.2, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +19 more potentially affected by unknown CVE via @sveltejs/kit (>=2.0.0, <=2.65.1)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =10.0.1, =0.1.0, =0.0.1-alpha.26, =2.0.0, =0.4.1, =5.0.0-alpha.1, =0.0.1, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-SVELTEJSKIT-18319510...

AWS CLI: Overly permissive File Permissions

Summary The AWS Command Line Interface AWS CLI is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host...