@8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4), @airmix/mcp-excalidraw-server (1.0.6) +243 more potentially affected by CVE-2026-71438 via mermaid (>=10.0.0, <=10.9.5)

mermaid NPM version =10.0.0, =0.18.0-beta.0, =0.17.0-alkemio-1, =1.0.0, =0.18.3, =0.18.0-1, =0.0.1-BETA, =0.18.1, =1.1.4, =0.0.1, =0.17.1, =0.0.19, =0.0.1, =0.0.1, =0.0.6 and more Source cves: CVE-2026-71438 Source advisory: OSV:GHSA-C4C3-PG64-4M4V...

NPM: Mermaid allows CSS injection applying to sibling elements of the diagram

NPM: Mermaid allows CSS injection applying to sibling elements of the diagram vulnerability discovered by ? in WordPress Npm mermaid versions 10.9.8...

@8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4), @airmix/mcp-excalidraw-server (1.0.6) +243 more potentially affected by CVE-2026-50159 via mermaid (>=10.0.0, <=10.9.5)

mermaid NPM version =10.0.0, =0.18.0-beta.0, =0.17.0-alkemio-1, =1.0.0, =0.18.3, =0.18.0-1, =0.0.1-BETA, =0.18.1, =1.1.4, =0.0.1, =0.17.1, =0.0.19, =0.0.1, =0.0.1, =0.0.6 and more Source cves: CVE-2026-50159 Source advisory: SNYK:JS-MERMAID-18592305...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.27), @142vip/vuepress (0.0.1-alpha.19) +210 more potentially affected by CVE-2026-50159 via mermaid (>=11.0.0, <=11.16.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.15.0, =0.35.0, =0.2.0, =1.0.1 and more Source cves: CVE-2026-50159 Source advisory: SNYK:JS-MERMAID-18592305...

@8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4), @airmix/mcp-excalidraw-server (1.0.6) +243 more potentially affected by CVE-2026-50159 via mermaid (>=10.0.0, <=10.9.5)

mermaid NPM version =10.0.0, =0.18.0-beta.0, =0.17.0-alkemio-1, =1.0.0, =0.18.3, =0.18.0-1, =0.0.1-BETA, =0.18.1, =1.1.4, =0.0.1, =0.17.1, =0.0.19, =0.0.1, =0.0.1, =0.0.6 and more Source cves: CVE-2026-50159 Source advisory: OSV:GHSA-6X64-9X62-F2GX...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.27), @142vip/vuepress (0.0.1-alpha.19) +210 more potentially affected by CVE-2026-50159 via mermaid (>=11.0.0, <=11.16.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.15.0, =0.35.0, =0.2.0, =1.0.1 and more Source cves: CVE-2026-50159 Source advisory: OSV:GHSA-6X64-9X62-F2GX...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.27), @142vip/vuepress (0.0.1-alpha.19) +119 more potentially affected by CVE-2026-71437 via mermaid (>=11.5.0, <=11.16.0)

mermaid NPM version =11.5.0, =0.0.1-alpha.23, =0.0.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.16.0, =0.35.0, =0.2.0, =1.0.1 - @cognitivesand/md2pdf 0.1.3 and more Source cves: CVE-2026-71437 Source advisory: OSV:GHSA-3RRR-JR9J-H3Q3...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.27), @142vip/vuepress (0.0.1-alpha.19) +119 more potentially affected by CVE-2026-71437 via mermaid (>=11.5.0, <=11.16.0)

mermaid NPM version =11.5.0, =0.0.1-alpha.23, =0.0.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.16.0, =0.35.0, =0.2.0, =1.0.1 - @cognitivesand/md2pdf 0.1.3 and more Source cves: CVE-2026-71437 Source advisory: SNYK:JS-MERMAID-18592329...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.27), @142vip/vuepress (0.0.1-alpha.19) +210 more potentially affected by CVE-2026-71436 via mermaid (>=11.0.0, <=11.16.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.15.0, =0.35.0, =0.2.0, =1.0.1 and more Source cves: CVE-2026-71436 Source advisory: SNYK:JS-MERMAID-18592327...

@8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4), @airmix/mcp-excalidraw-server (1.0.6) +200 more potentially affected by CVE-2026-71436 via mermaid (>=10.6.1, <=10.9.5)

mermaid NPM version =10.6.1, =0.18.0-beta.0, =0.17.1-alkemio-5, =1.0.0, =0.18.3, =0.18.0-1, =0.0.1-BETA, =0.18.1, =1.1.4, =0.0.1, =0.0.1, =0.0.1, =7.1.0, =0.114.3, =0.141.3 and more Source cves: CVE-2026-71436 Source advisory: OSV:GHSA-2V8P-3F2J-5MP7...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.27), @142vip/vuepress (0.0.1-alpha.19) +210 more potentially affected by CVE-2026-71436 via mermaid (>=11.0.0, <=11.16.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.15.0, =0.35.0, =0.2.0, =1.0.1 and more Source cves: CVE-2026-71436 Source advisory: OSV:GHSA-2V8P-3F2J-5MP7...

@8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4), @airmix/mcp-excalidraw-server (1.0.6) +200 more potentially affected by CVE-2026-71436 via mermaid (>=10.6.1, <=10.9.5)

mermaid NPM version =10.6.1, =0.18.0-beta.0, =0.17.1-alkemio-5, =1.0.0, =0.18.3, =0.18.0-1, =0.0.1-BETA, =0.18.1, =1.1.4, =0.0.1, =0.0.1, =0.0.1, =7.1.0, =0.114.3, =0.141.3 and more Source cves: CVE-2026-71436 Source advisory: SNYK:JS-MERMAID-18592327...

MAL-2026-13468 Malicious code in xdaxx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7cd212c80bcca22443f4498afeadb70b93268b5904daa521b83242513d478bd The tarball contains a working browser-side account-takeover payload gated to run on noviembrenacional.com. When loaded in a logged-in victim's...

Malicious code in sui-graphql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1165aedcef955ec318bb0a4e8c965b41ca89ab7a2ee70d3861ae5f22cb3e2fdb Package [email protected] was scanned across 3 files with no a static rule matches and no traced behaviors indicating exfiltration, install-ti...

MAL-2026-13476 Malicious code in sui-migration-audit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde60caa9a24d7775679269b1c468e4d2aa850e819104cd66c25dde8fb6931af Package [email protected] contains 2 scanned files. No install-time lifecycle hooks, credential access, network exfiltration, dropper,...

@appweaver/core (>=1.1.6, <=1.4.1), @cappa/cli (0.11.1) +32 more potentially affected by CVE-2026-18427 via @fastify/static (>=10.1.0, <=10.1.2)

@fastify/static NPM version =10.1.0, =1.1.6, =7.0.0-canary.3011, =7.0.0-canary.3011, =7.0.0-canary.3011, =7.0.0-canary.3011, =7.0.0-canary.3011, =7.0.0-canary.3011, =7.0.0-canary.3011, =7.0.0-canary.3011, =7.0.0-canary.3011, =0.0.4, =0.0.6 - @darthcav/ts-http-server 0.9.1 - @digitalpaws/starr 0.0...

@cmmv/ai (0.0.5), @graphql-mesh/neo4j (>=0.103.0, <=0.106.2) +2 more potentially affected by CVE-2026-5423 via @neo4j/graphql (6.6.4)

@neo4j/graphql NPM version 6.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on @neo4j/graphql and may be impacted: - @cmmv/ai 0.0.5 - @graphql-mesh/neo4j =0.103.0, =0.7.13-alpha-20241031110808-e6f493d3529c46de0c7c0358ed1e2b5942f2a2a2, =0.7.0, =0.10.2...

aitable-workflow-cli (9.9.9) potentially affected by unknown CVE via aitable-workflow-server (9.9.9)

aitable-workflow-server NPM version 9.9.9 is affected by a known vulnerability. The following packages have a transitive dependency on aitable-workflow-server and may be impacted: - aitable-workflow-cli 9.9.9 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13437...

Malicious code in merchantweb-lang-cookie-reset (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fff16333aa7ffc7fc2c7decc1458c23b7d89f8caacb5c6129ba76168d08ec4be package.json declares the sole dependency packet-table-thread-stream as a direct tarball URL to a non-npm host...

Malicious code in streak-map-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ae48e032b5494c8939d41973598b9dd35d5954ccf6850cd633e7992995cc6b The package advertises itself as a dependency-free day/streak math library, but its main entrypoint dist/index.mjs contains a top-level async IIFE th...