3llm (0.0.1), @3bitmt/3bit-sidebar-dashboard (1.1.4) +263 more potentially affected by unknown CVE via next (>=15.1.1, <=15.1.11)

next NPM version =15.1.1, =0.0.4-alpha-20241218130538-b1235534784f95b3524711b50802add67747c676, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.1, =0.1.1, =0.1.0, =1.0.0, =3.1.2, =3.1.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H25M-26QC-WCJF...

OSV-2026-136 Memcpy-param-overlap in grk::memStreamRead

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=478035120 Crash type: Memcpy-param-overlap Crash state: grk::memStreamRead grk::BufferedStream::read grk::MarkerParser::readSOTorEOC...

@ancademy/bespoke-classic-client (>=2.2.6, <=2.7.8-alpha.1), @ancademy/bespoke-classic-robot (>=2.2.6, <=2.7.8-alpha.2) +111 more potentially affected by CVE-2026-23967 via sm-crypto (>=0.0.9, <=0.3.13)

sm-crypto NPM version =0.0.9, =2.2.6, =2.2.6, =2.2.6, =2.3.10, =2.1.4, =2.2.6, =2.2.6, =2.2.6, =2.1.15, =2.7.0, =2.1.15, =2.1.4, =2.7.7, =2.7.0, =2.7.8-alpha.1 and more Source cves: CVE-2026-23967 Source advisory: OSV:GHSA-QV7W-V773-3XQM...

@beshkenadze/orval-mcp (7.11.2-fix.2), @latest-version/orval-angular (7.4.1) +19 more potentially affected by CVE-2026-23947 +1 more via @orval/core (>=7.0.0, <=7.18.0)

@orval/core NPM version =7.0.0, =7.4.1, =7.4.1, =7.4.1, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.9.0, =7.0.0, =7.0.0, =7.0.0, =7.18.0 and more Source cves: CVE-2026-23947, CVE-2026-25141 Source advisory: OSV:GHSA-H526-WF6G-67JV...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.4.3) +11 more potentially affected by CVE-2026-22031 +1 more via @fastify/middie (>=9.0.2, <=9.0.3)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.95 Source cves: CVE-2026-22031, CVE-2026-6414 Source advisory: OSV:GHSA-CXRG-G7R8-W69P...

@cenk1cenk2/renovate-config (>=2.0.0, <=2.3.148), @jamietanna/patch-testing (>=0.1.0, <=0.2.28) +8 more potentially affected by CVE-2026-76231 via renovate (>=32.241.11, <=40.21.2)

renovate NPM version =32.241.11, =2.0.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.2.0, =0.0.1, =0.19.0 - @zotero-chinese/renovate-config 1.0.3 Source cves: CVE-2026-76231 Source advisory: OSV:GHSA-36J9-MX87-2CFF...

@regis-samurai/n8n (>=0.216.1, <=0.219.1), n8n-nodes-accelo (>=0.1.0, <=0.1.9) +7 more potentially affected by CVE-2026-21894 via n8n (>=0.170.0, <=0.219.1)

n8n NPM version =0.170.0, =0.216.1, =0.1.0, =0.18.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.7 Source cves: CVE-2026-21894 Source advisory: OSV:GHSA-JF52-3F2H-H9J5...

a1 (>=1.0.1, <=1.0.2), actor-kit (>=0.1.0, <=0.2.5) +112 more potentially affected by unknown CVE via rkyv (0.8.2)

rkyv CARGO version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on rkyv and may be impacted: - a1 =1.0.1, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.9.0, =0.5.0, =0.5.0, =0.1.0-beta.2, =0.2.0 - fluxbench-logic 0.2.0 - fluxbench-report 0.2.0 and more Sour...

ars-package (>=0.0.1, <=0.0.10), bosque (0.1.0) +157 more potentially affected by unknown CVE via rkyv (>=0.1.1, <=0.7.45)

rkyv CARGO version =0.1.1, =0.0.1, =0.1.3, =0.4.1 - cell-model 0.4.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0001...

OSV-2025-1039 UNKNOWN WRITE in fuzz_regexp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=471926738 Crash type: UNKNOWN WRITE Crash state: fuzzregexp...

OSV-2025-1020 Heap-buffer-overflow in mmcall

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=471093652 Crash type: Heap-buffer-overflow WRITE 8 Crash state: mmcall ljmetatset ljvmetatsetv...

aperture-shared (0.1.0), cafs (0.0.1) +65 more potentially affected by unknown CVE via capnp (>=0.0.1, <=0.23.2)

capnp CARGO version =0.0.1, =0.0.1, =0.2.0, =0.1.0, =0.0.1, =0.1.0, =0.0.1, =0.6.0, =0.5.0, =0.0.2, =0.2.0-rc, =0.2.5-alpha.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0143...

@asherng/storybook (>=0.0.18, <=0.1.14), @bluefin-exchange/starship-v2 (>=1.1.1, <=1.1.16) +32 more potentially affected by CVE-2025-68429 via storybook (>=7.0.6, <=7.6.20)

storybook NPM version =7.0.6, =0.0.18, =1.1.1, =0.0.1, =0.0.4, =1.2.108, =3.50.0-next.2, =9.0.0-next.4, =1.0.967, =0.0.1, =1.0.0-beta.1, =1.2.2, =0.0.1, =0.0.1, =7.6.4-next.32, =6.0.0-canary.234, =6.0.0-canary.318 and more Source cves: CVE-2025-68429 Source advisory: OSV:GHSA-8452-54WP-RMV6...

@asherng/storybook (>=1.0.6, <=1.0.15), @asng/storybook (>=0.0.0-AddSnapshotPipeline-20240326102812, <=0.0.10) +32 more potentially affected by CVE-2025-68429 via storybook (>=8.0.2, <=8.6.14)

storybook NPM version =8.0.2, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =1.5.1-canary.0, =0.4.2, =0.1.3, =1.0.0-canary.12734, =0.11.1-aa792aa-20250325153437, =0.12.1-aa792aa-20250325153437, =0.0.1-10adad4-20260325085110, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =7.33.6-qa-airteam-7.35.1.0,...

@cedarjs/api-server (>=1.0.0-canary.12879, <=1.0.0-canary.12881), @cedarjs/cli (>=1.0.0-canary.12879, <=1.0.0-canary.12881) +10 more potentially affected by CVE-2025-67779 via react-server-dom-webpack (19.2.2)

react-server-dom-webpack NPM version 19.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @cedarjs/api-server =1.0.0-canary.12879, =1.0.0-canary.12879, =1.0.0-canary.12879, =1.0.0-canary.12879,...

@adenta/cms (>=0.0.6, <=1.1.1-0), @alisonquinter17/alieta-ui (0.1.0) +126 more potentially affected by CVE-2025-55184 via next (>=15.4.0-canary.17, <=15.4.8)

next NPM version =15.4.0-canary.17, =0.0.6, =0.1.0, =1.2.4-main.7f918ee.29, =0.2.0, =1.0.0, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.4, =0.0.1, =1.1.0, =0.1.3, =0.5.0 and more Source cves: CVE-2025-55184 Source advisory: OSV:GHSA-MWV6-3258-Q52C...

ai-sdk-provider-claude-code (>=0.2.0, <=1.1.1), claude-code-webui (>=0.1.34, <=0.1.50) +6 more potentially affected by CVE-2025-66032 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.90)

@anthropic-ai/claude-code NPM version =1.0.8, =0.2.0, =0.1.34, =1.8.0, =0.1.44, =0.0.22, =0.0.27, =0.0.28 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-66032 Source advisory: OSV:GHSA-XQ4M-MC3C-VVG3...

GO-2025-4149 OSV-SCALIBR has NULL Pointer Dereference in github.com/google/osv-scalibr

OSV-SCALIBR has NULL Pointer Dereference in github.com/google/osv-scalibr...

@asyncapi/cli (>=1.4.0, <=2.16.7) potentially affected by unknown CVE via @asyncapi/studio (0.20.2)

@asyncapi/studio NPM version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on @asyncapi/studio and may be impacted: - @asyncapi/cli =1.4.0, =2.16.7 Source cves: unknown CVE Source advisory: OSV:MAL-2025-190863...

CVE-2025-13425 Denial of Service in OSV-SCALIBR

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic index out of range and an application crash denial of service in OSV-SCALIBR...