@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by CVE-2026-82868 via @pdfme/schemas (5.5.8)

@pdfme/schemas NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: CVE-2026-82868 Source advisory: OSV:GHSA-87V3-4CFP-CM76...

@228-fund/elysia-effect (0.0.1), @228-fund/elysia-msgpack (>=0.0.1, <=0.0.3) +65 more potentially affected by CVE-2026-31865 via elysia (>=1.0.9, <=1.4.26)

elysia NPM version =1.0.9, =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.4, =0.1.0, =0.1.0-next.4, =1.0.0-next.4, =1.0.0, =0.0.1, =1.0.3, =1.0.10 and more Source cves: CVE-2026-31865 Source advisory: OSV:GHSA-8HQ9-PHH3-P2WP...

ale_python_parser (0.1.0), anni-repo (>=0.2.0, <=0.4.1) +105 more potentially affected by CVE-2026-32829 via lz4_flex (>=0.7.5, <=0.10.0)

lz4flex CARGO version =0.7.5, =0.2.0, =0.1.0, =0.0.1, =0.1.3, =0.0.1, =0.2.0, =0.4.0, =0.12.1, =1.0.0-beta.1, =0.2.5, =0.2.7 - dekoder 0.1.0 - diamond-types 1.0.0 and more Source cves: CVE-2026-32829 Source advisory: OSV:RUSTSEC-2026-0041...

ale_python_parser (0.1.0), anni-repo (>=0.2.0, <=0.4.1) +105 more potentially affected by CVE-2026-32829 via lz4_flex (>=0.7.5, <=0.10.0)

lz4flex CARGO version =0.7.5, =0.2.0, =0.1.0, =0.0.1, =0.1.3, =0.0.1, =0.2.0, =0.4.0, =0.12.1, =1.0.0-beta.1, =0.2.5, =0.2.7 - dekoder 0.1.0 - diamond-types 1.0.0 and more Source cves: CVE-2026-32829 Source advisory: OSV:GHSA-VVP9-7P8X-RFVV...

@tinacms/app (>=0.0.0-0b7103c-20251216023146, <=2.3.24), @tinacms/cli (>=0.0.0-0b7103c-20251216023146, <=2.1.5) +4 more potentially affected by CVE-2026-24125 via @tinacms/graphql (>=2.0.0, <=2.1.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =3.4.1 Source cves: CVE-2026-24125 Source advisory: OSV:GHSA-2238-XC5R-V9HJ...

acril-http (0.1.0), ajars_surf (>=0.3.0, <=0.8.0) +133 more potentially affected by unknown CVE via http-types (>=1.3.1, <=2.12.0)

http-types CARGO version =1.3.1, =0.3.0, =0.0.1, =0.10.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =6.0.0, =0.1.1, =0.0.4, =0.0.18 - crudhenriquecapi 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0174...

@adenta/cms (>=0.0.6, <=1.1.1-0), @adobe/helix-deploy (>=11.0.19, <=11.1.15) +544 more potentially affected by CVE-2026-31802 via tar (>=7.0.0, <=7.5.10)

tar NPM version =7.0.0, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =0.1.1, =0.1.1, =2.17.11, =1.9.5, =8.8.3, =8.11.4 - @altipla/directus-sdk-utils 0.7.2 - @applitools/core 4.20.0 - @applitools/core-base 1.17.0 - @applitools/ec-client 1.9.6 - @applitools/eyes 1.23.0 - @applitools/eyes-playwright 1.29.1 and...

@ekairos/dataset (>=1.21.32-beta.0, <=1.22.22-beta.development.0), @ekairos/events (>=1.22.4-beta.development.0, <=1.22.34-beta.development.0) +10 more potentially affected by unknown CVE via workflow (>=4.0.1-beta.0, <=4.1.0-beta.63)

workflow NPM version =4.0.1-beta.0, =1.21.32-beta.0, =1.22.4-beta.development.0, =1.21.32-beta.0, =1.21.53-beta.0, =1.21.88-beta.0, =0.0.0-dev-20260121145510, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =4.0.1-beta.0, =1.21.32-beta.0, =0.3.0, =0.7.7 Source cve...

@ekairos/dataset (>=1.21.32-beta.0, <=1.22.22-beta.development.0), @ekairos/events (>=1.22.4-beta.development.0, <=1.22.34-beta.development.0) +26 more potentially affected by unknown CVE via @workflow/core (>=4.0.1-beta.0, <=4.1.0-beta.63)

@workflow/core NPM version =4.0.1-beta.0, =1.21.32-beta.0, =1.22.4-beta.development.0, =1.21.32-beta.0, =1.21.53-beta.0, =1.21.88-beta.0, =0.0.0-dev-20260121145510, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =4.0.0-beta.2, =4.0.1-beta.4, =4.0.1-beta.0,...

@amedia/brick-mcp (>=0.0.0-vSNAPSHOT-20260217144000, <=1.0.0), @area15/ticket-component (0.1.0) +104 more potentially affected by CVE-2026-3419 via fastify (>=5.7.2, <=5.7.4)

fastify NPM version =5.7.2, =0.0.0-vSNAPSHOT-20260217144000, =0.5.2, =0.5.2, =0.5.2, =0.5.2, =0.2.11, =2.4.2-next.143, =2.4.2-next.143, =2.4.2-next.143, =2.4.2-next.143, =2.11.6, =5.1.19, =2.21.2, =2.21.2, =2.21.3 and more Source cves: CVE-2026-3419 Source advisory: OSV:GHSA-573F-X89G-HQP9...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.7.1) +11 more potentially affected by CVE-2026-2880 via @fastify/middie (>=9.0.2, <=9.1.0)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.95 Source cves: CVE-2026-2880 Source advisory: OSV:GHSA-8P85-9QPW-FWGW...

@boxcustodia/library (>=1.5.1-canary.0, <=1.5.1-canary.2), @buttery/cli (>=0.4.2, <=0.4.11) +28 more potentially affected by CVE-2026-27148 via storybook (>=8.1.1, <=8.6.16)

storybook NPM version =8.1.1, =1.5.1-canary.0, =0.4.2, =0.1.3, =1.0.0-canary.12734, =0.11.1-aa792aa-20250325153437, =0.12.1-aa792aa-20250325153437, =0.0.1-10adad4-20260325085110, =9.0.0-next.51, =7.33.6-qa-airteam-7.35.1.0, =0.0.3, =2.0.0-beta.1, =0.2.36, =0.1.51, =2.0.3 -...

parse-hipaa-dashboard (>=1.5.0, <=2.0.5) potentially affected by CVE-2026-27608 via parse-dashboard (>=7.3.0, <=8.5.0)

parse-dashboard NPM version =7.3.0, =1.5.0, =2.0.5 Source cves: CVE-2026-27608 Source advisory: OSV:GHSA-CVWJ-6C9H-JG6V...

OSV-2026-300 UNKNOWN WRITE in nmeaid_to_prn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486727024 Crash type: UNKNOWN WRITE Crash state: nmeaidtoprn processGSV nmeaparse...

@deno/sandbox (>=0.0.9, <=0.6.0), @ekairos/dataset (>=1.21.56-beta.0, <=1.22.22-beta.development.0) +51 more potentially affected by unknown CVE via devalue (>=5.0.0, <=5.6.2)

devalue NPM version =5.0.0, =0.0.9, =1.21.56-beta.0, =1.22.4-beta.development.0, =1.21.56-beta.0, =1.21.67-beta.0, =1.21.88-beta.0, =0.0.0-dev-20260121145510, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =2.3.65, =1.1.27, =1.1.21, =1.2.263, =2.2.3, =4.0.1 and...

OSV-2026-226 UNKNOWN WRITE in decode_xa2_00

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=482909898 Crash type: UNKNOWN WRITE Crash state: decodexa200 tsipparseinput gpsdpoll...

OSV-2026-205 UNKNOWN READ in gpsd_poll

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=481932457 Crash type: UNKNOWN READ Crash state: gpsdpoll FuzzDrivers.c...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @netlify/agent-runner-cli (>=1.31.0-alpha, <=1.57.0) +14 more potentially affected by CVE-2026-25722 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.55)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =1.31.0-alpha, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =0.11.1, =0.11.0, =1.0.0, =0.10.2, =0.11.5 and more Source cves: CVE-2026-25722 Source advisory: OSV:GHSA-66Q4-VFJG-2QHH...

acid-rs (>=1.1.0, <=1.1.1), agpm_pm (>=0.0.1, <=0.0.2) +919 more potentially affected by unknown CVE via git2 (>=0.1.21, <=0.19.0)

git2 CARGO version =0.1.21, =1.1.0, =0.0.1, =0.3.0, =1.0.0, =0.1.0, =2.0.0-rc.1, =0.2.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-J39J-6GW9-JW6H...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2155 more potentially affected by CVE-2026-25536 via @modelcontextprotocol/sdk (>=1.10.0, <=1.25.3)

@modelcontextprotocol/sdk NPM version =1.10.0, =0.3.3, =1.0.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.4.2, =0.0.1, =0.0.1, =1.0.0, =1.1.0, =1.0.0, =10.1.0-rc.1, =10.2.1 and more Source cves: CVE-2026-25536 Source advisory: OSV:GHSA-345P-7CG4-V4C7...