org.webjars.npm:autolinker (>=0.24.1, <=0.28.1), org.webjars.npm:github-com-mattslocum-ng-webworker (0.2.3) +10 more potentially affected by CVE-2021-23337 +1 more via org.webjars.npm:lodash.template (4.5.0)

org.webjars.npm:lodash.template MAVEN version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:lodash.template and may be impacted: - org.webjars.npm:autolinker =0.24.1, =2.9.0, =1.8.12, =3.5.0, =2.3.4, =2.5.17-beta.0 -...

org.webjars.npm:compression-webpack-plugin (7.1.1), org.webjars.npm:copy-webpack-plugin (>=4.3.1, <=4.6.0) +9 more potentially affected by CVE-2026-34043 via org.webjars.npm:serialize-javascript (>=1.9.1, <=6.0.2)

org.webjars.npm:serialize-javascript MAVEN version =1.9.1, =4.3.1, =5.2.0, =1.1.6, =2.3.4, =2.5.17-beta.0 Source cves: CVE-2026-34043 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15809197...

org.webjars.npm:canvas (>=2.5.0, <=2.6.0), org.webjars.npm:color-thief (2.2.5) +12 more potentially affected by CVE-2026-31802 via org.webjars.npm:tar (>=0.1.20, <=4.4.19)

org.webjars.npm:tar MAVEN version =0.1.20, =2.5.0, =0.97.5, =0.2.0, =3.4.0, =0.6.19, =2.0.0, =3.1.4, =3.4.1 - org.webjars.npm:tar.gz 1.0.7 Source cves: CVE-2026-31802 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15456202...

org.webjars.npm:nestjs__platform-express (>=8.4.7, <=9.0.0-next.2) potentially affected by CVE-2026-3520 via org.webjars.npm:multer (1.4.4-lts.1)

org.webjars.npm:multer MAVEN version 1.4.4-lts.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:multer and may be impacted: - org.webjars.npm:nestjsplatform-express =8.4.7, =9.0.0-next.2 Source cves: CVE-2026-3520 Source advisory:...

ai.hyacinth.framework:core-service-trigger-server (>=0.5.0, <=0.5.24), ai.stainless:grails-tika (0.1.0) +5010 more potentially affected by CVE-2026-27727 via com.mchange:mchange-commons-java (>=0.2.2, <=0.3.2)

com.mchange:mchange-commons-java MAVEN version =0.2.2, =0.5.0, =0.0.1, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 and more Source cves: CVE-2026-27727 Source advisory: MEND:CVE-2026-27727...

org.webjars.npm:jsrsasign-util (1.0.5) potentially affected by CVE-2026-4602 via org.webjars.npm:jsrsasign (11.1.0)

org.webjars.npm:jsrsasign MAVEN version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:jsrsasign and may be impacted: - org.webjars.npm:jsrsasign-util 1.0.5 Source cves: CVE-2026-4602 Source advisory:...

com.netflix.ndbench:ndbench-cli (>=0.3.12, <=0.7.4), com.netflix.ndbench:ndbench-geode-plugins (>=0.3.5, <=0.7.4) +35 more potentially affected by CVE-2026-2818 via org.springframework.data:spring-data-geode (>=1.0.0.incubating-release, <=2.7.18)

org.springframework.data:spring-data-geode MAVEN version =1.0.0.incubating-release, =0.3.12, =0.3.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =3.0.0, =3.2.1...

be.cylab.mark:client (>=0.0.10, <=0.0.23), be.cylab.mark:example (>=0.0.22, <=0.0.23) +62 more potentially affected by CVE-2026-24802 via com.github.briandilley.jsonrpc4j:jsonrpc4j (>=1.0, <=1.6)

com.github.briandilley.jsonrpc4j:jsonrpc4j MAVEN version =1.0, =0.0.10, =0.0.22, =0.0.10, =0.0.1, =0.0.1.release, =0.1-alpha-1, =1.0.0, =1.0, =0.1.0, =1.0.0, =1.2.0, =1.7.1, =1.7.9 and more Source cves: CVE-2026-24802 Source advisory: SNYK:JAVA-COMGITHUBBRIANDILLEYJSONRPC4J-15127916...

cn.herodotus.engine:oauth2-authentication-autoconfigure (>=3.5.5.3, <=3.5.6.2), cn.herodotus.engine:oauth2-authorization-server-autoconfigure (>=3.3.0.5, <=3.5.5.2) +2 more potentially affected by CVE-2026-23967 via org.webjars.npm:sm-crypto (0.3.13)

org.webjars.npm:sm-crypto MAVEN version 0.3.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sm-crypto and may be impacted: - cn.herodotus.engine:oauth2-authentication-autoconfigure =3.5.5.3, =3.3.0.5, =3.3.0.5, =3.5.5.3, =3.5.6.2...

io.github.wwwlike:vlife-boot-starter-web (>=1.0.4, <=1.0.7), io.github.wwwlike:vlife-core (>=1.0.4, <=1.0.7) +2 more potentially affected by CVE-2025-13266 via io.github.wwwlike:vlife-base (>=1.0.4, <=1.0.7)

io.github.wwwlike:vlife-base MAVEN version =1.0.4, =1.0.4, =1.0.4, =1.0.4, =1.0.2, =1.0.7 Source cves: CVE-2025-13266 Source advisory: SNYK:JAVA-IOGITHUBWWWLIKE-14038399...

org.webjars.npm:vega-embed (6.21.0) potentially affected by CVE-2025-59840 via org.webjars.npm:vega-interpreter (1.0.4)

org.webjars.npm:vega-interpreter MAVEN version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:vega-interpreter and may be impacted: - org.webjars.npm:vega-embed 6.21.0 Source cves: CVE-2025-59840 Source advisory:...

org.webjars.bowergithub.lostinbrittany:granite-yaml (1.1.0) potentially affected by CVE-2025-64718 via org.webjars.bowergithub.nodeca:js-yaml (3.14.1)

org.webjars.bowergithub.nodeca:js-yaml MAVEN version 3.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.bowergithub.nodeca:js-yaml and may be impacted: - org.webjars.bowergithub.lostinbrittany:granite-yaml 1.1.0 Source cves:...

EUVD-2021-11021

Malware in sbrugna...

org.webjars.bower:jspdf-autotable (>=2.0.2, <=2.1.0) potentially affected by CVE-2025-57810 via org.webjars.bower:jspdf (>=1.0.272, <=1.4.1)

org.webjars.bower:jspdf MAVEN version =1.0.272, =2.0.2, =2.1.0 Source cves: CVE-2025-57810 Source advisory: SNYK:JAVA-ORGWEBJARSBOWER-12205534...

org.webjars.npm:compression (>=1.5.2, <=1.7.4), org.webjars.npm:express-session (>=1.15.6, <=1.17.1) +1 more potentially affected by CVE-2025-7339 via org.webjars.npm:on-headers (1.0.2)

org.webjars.npm:on-headers MAVEN version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:on-headers and may be impacted: - org.webjars.npm:compression =1.5.2, =1.15.6, =1.9.0, =1.9.1 Source cves: CVE-2025-7339 Source advisory:...

An Accurate and Efficient Vulnerability Propagation Analysis Framework

Identifying the impact scope and scale is critical for software supply chain vulnerability assessment. However, existing studies face substantial limitations. First, prior studies either work at coarse package-level granularity, producing many false positives, or fail to accomplish whole-ecosyste...

org.webjars.npm:nestjs__platform-express (>=8.4.7, <=9.0.0-next.2) potentially affected by CVE-2025-47944 via org.webjars.npm:multer (1.4.4-lts.1)

org.webjars.npm:multer MAVEN version 1.4.4-lts.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:multer and may be impacted: - org.webjars.npm:nestjsplatform-express =8.4.7, =9.0.0-next.2 Source cves: CVE-2025-47944 Source advisory:...

org.webjars.npm:bitcore-lib (0.15.0), org.webjars.npm:bitcore-mnemonic (1.5.0) +5 more potentially affected by CVE-2025-27611 via org.webjars.npm:base-x (3.0.8)

org.webjars.npm:base-x MAVEN version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:base-x and may be impacted: - org.webjars.npm:bitcore-lib 0.15.0 - org.webjars.npm:bitcore-mnemonic 1.5.0 - org.webjars.npm:bs58 4.0.1 -...

com.github.grantlittle:bdd-reporting-server (>=0.1.5, <=0.1.7), com.github.grantlittle:bdd-reporting-service (0.1.9) +697 more potentially affected by CVE-2025-0716 via org.webjars.bower:angular (>=1.0.7, <=1.8.3)

org.webjars.bower:angular MAVEN version =1.0.7, =0.1.5, =1.1.0, =0.4.4, =0.4.4, =0.3.5, =0.4.1, =0.4.4, =0.3.5, =0.4.4, =0.5.1 and more Source cves: CVE-2025-0716 Source advisory: SNYK:JAVA-ORGWEBJARSBOWER-9919774...

org.webjars.npm:angular-lock (2.0.3), org.webjars.npm:auth0-js (>=8.4.0, <=9.28.0) +11 more potentially affected by CVE-2025-46653 via org.webjars.npm:formidable (>=1.2.2, <=2.1.2)

org.webjars.npm:formidable MAVEN version =1.2.2, =8.4.0, =4.0.0-alpha, =1.1.0, =2.1.7, =1.0.6, =3.3.1, =7.1.6 - org.webjars.npm:supertest 3.4.2 Source cves: CVE-2025-46653 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-10006768...