@jamietanna/renovate-graph (>=0.24.0, <=0.30.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (>=0.6.5, <=1.0.1) potentially affected by unknown CVE via renovate (>=39.230.2, <=40.21.2)

renovate NPM version =39.230.2, =0.24.0, =0.6.5, =1.0.1 Source cves: unknown CVE Source advisory: SNYK:JS-RENOVATE-14927387...

@cocoar/scenar-cli (>=0.1.0-beta.54, <=0.1.0-beta.68), @eui/deps-base (>=21.0.0-alpha.10, <=21.0.3-snapshot-1768918434957) +2 more potentially affected by CVE-2026-22610 via @angular/core (>=21.0.0, <=21.0.6)

@angular/core NPM version =21.0.0, =0.1.0-beta.54, =21.0.0-alpha.10, =21.0.0-alpha.10, =21.0.3-snapshot-1768918434957 - zax-dashboard 1.0.14 Source cves: CVE-2026-22610 Source advisory: SNYK:JS-ANGULARCORE-14908871...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +32 more potentially affected by CVE-2026-22610 via @angular/core (>=20.0.0, <=20.3.15)

@angular/core NPM version =20.0.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.10.1, =0.10.2 and more Source cves: CVE-2026-22610 Source advisory: OSV:GHSA-JRMJ-C5CX-3CW6...

muaddib-scanner (>=1.1.0, <=1.1.1) potentially affected by unknown CVE via @vietmoney/react-big-calendar (0.0.1-security)

@vietmoney/react-big-calendar NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @vietmoney/react-big-calendar and may be impacted: - muaddib-scanner =1.1.0, =1.1.1 Source cves: unknown CVE Source advisory:...

aperture-shared (0.1.0), assemblylift-awslambda-host (>=0.2.0, <=0.3.0) +114 more potentially affected by unknown CVE via capnp (>=0.0.1, <=0.23.2)

capnp CARGO version =0.0.1, =0.2.0, =0.3.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.0.1, =0.23.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0143...

10minions-engine (>=0.0.1, <=0.0.4), @0xd541ecb3/byte-babe (>=1.0.0, <=1.2.1) +1008 more potentially affected by CVE-2025-68665 via langchain (>=0.0.11, <=0.3.35)

langchain NPM version =0.0.11, =0.0.1, =1.0.0, =0.0.1, =0.0.6, =0.1.4, =3.0.0-beta.65.0, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.1.5-alpha.2, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.1.6 and more Source cves: CVE-2025-68665 Source advisory:...

@andrewcturing/todoist (0.0.1), @bento-core/navigator (1.0.0) +57 more potentially affected by CVE-2026-9673 via json-2-csv (>=3.20.0, <=5.5.10)

json-2-csv NPM version =3.20.0, =1.8.0, =5.0.2, =0.0.1, =0.2.3, =0.1.0, =0.1.0, =0.5.1, =1.0.2, =1.3.1, =1.3.1-next.0, =1.4.0, =2.0.1 and more Source cves: CVE-2026-9673 Source advisory: SNYK:JS-JSON2CSV-14221326...

ai-sdk-provider-claude-code (>=0.2.0, <=1.0.0-beta.1), locadex (0.0.2-alpha.1) potentially affected by CVE-2025-65099 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.24)

@anthropic-ai/claude-code NPM version =1.0.8, =0.2.0, =1.0.0-beta.1 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-65099 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-14073012...

dev.savantly.nexus:agents-module (3.4.0), dev.savantly.nexus:flow-module (3.4.0) +43 more potentially affected by CVE-2025-64408 via org.apache.causeway.core:causeway-core-runtimeservices (>=2.0.0, <=4.0.0-m2)

org.apache.causeway.core:causeway-core-runtimeservices MAVEN version =2.0.0, =4.0.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.causeway.core:causeway-core-runtimeservices and may be impacted: - dev.savantly.nexus:agents-module 3.4.0 ...

@omni-co/vega-lite (>=6.2.0-fork.2, <=6.2.0-fork.2-beta.2), arakawa (0.1.0-alpha.1) +3 more potentially affected by CVE-2025-59840 via vega-expression (6.0.0)

vega-expression NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on vega-expression and may be impacted: - @omni-co/vega-lite =6.2.0-fork.2, =6.0.0, =6.0.0, =6.0.0, =6.3.1 Source cves: CVE-2025-59840 Source advisory: OSV:GHSA-7F2V-3QQ3-VV...

siddheshtea (1.1.6) potentially affected by unknown CVE via manda-5 (1.0.0)

manda-5 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on manda-5 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-159648...

siddheshtea (1.1.6) potentially affected by unknown CVE via muklis-26 (1.0.0)

muklis-26 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on muklis-26 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-160810...

@dargmuesli/nuxt-vio (>=16.0.5, <=18.3.14) potentially affected by CVE-2025-52662 via @nuxt/devtools (>=2.0.0, <=2.6.3)

@nuxt/devtools NPM version =2.0.0, =16.0.5, =18.3.14 Source cves: CVE-2025-52662 Source advisory: SNYK:JS-NUXTDEVTOOLS-13849298...

com.liferay.content-targeting:com.liferay.content.targeting.analytics.api (>=2.0.1, <=3.0.0), com.liferay.content-targeting:com.liferay.content.targeting.anonymous.users.api (>=2.0.1, <=2.0.2) +316 more potentially affected by CVE-2025-62249 via com.liferay.portal:com.liferay.portal.impl (>=1.0.0, <=114.1.0)

com.liferay.portal:com.liferay.portal.impl MAVEN version =1.0.0, =2.0.1, =2.0.1, =3.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.20, =1.0.0, =1.0.0, =2.0.13 and more Source cves: CVE-2025-62249 Source adv...

@angular-devkit/build-angular (>=20.1.0-next.3, <=20.2.0-next.2), @angular/build (>=20.1.0-next.3, <=20.2.0-next.2) +60 more potentially affected by CVE-2025-62522 via vite (>=7.0.0, <=7.0.6)

vite NPM version =7.0.0, =20.1.0-next.3, =20.1.0-next.3, =0.0.4, =0.2.9, =1.0.0, =1.190.0, =0.1.0, =19.3.2-snapshot-1752652198707, =19.3.2-snapshot-1752652198707, =0.0.1750946288791, =0.0.2, =0.3.0 and more Source cves: CVE-2025-62522 Source advisory: OSV:GHSA-93M4-6634-74Q7...

doge_dns (>=0.2.4-beta, <=1.0.2), rev-up-your-harley (>=0.1.0, <=1.0.1) +3 more potentially affected by unknown CVE via unic-idna (>=0.5.0, <=0.9.0)

unic-idna CARGO version =0.5.0, =0.2.4-beta, =0.1.0, =0.1.0, =0.5.0, =0.7.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0085...

EUVD-2025-22475

Malicious code in bioql PyPI...

@amoscmc/dummy-package (>=1.3.1, <=1.3.3), @bitrefill/airfill-widget (>=4.2.2, <=4.8.3) +88 more potentially affected by CVE-2025-57318 via csvjson (>=1.0.5, <=5.1.0)

csvjson NPM version =1.0.5, =1.3.1, =4.2.2, =1.0.0, =1.0.6, =1.0.93, =0.0.4, =0.1.0, =0.5.1, =1.0.0, =0.1.0, =0.1.0, =1.0.0, =1.1.1 and more Source cves: CVE-2025-57318 Source advisory: SNYK:JS-CSVJSON-13110014...

@alexaegis/setup-editorconfig (>=0.0.1, <=0.0.5), @alexaegis/setup-workspace (>=0.0.1, <=0.0.5) +156 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=0.6.1, <=2.3.1)

vite-plugin-static-copy NPM version =0.6.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =16.5.0, =1.0.0-beta-v2.0.0, =0.4.3, =0.0.16, =1.0.4, =1.1.0, =0.0.1-rc-051923-9-a, =0.0.1-rc-050123-5, =0.0.1-rc-051823-5-c - @cqsjjb/scripts 3.0.0-vite.1 and more Source cves: CVE-2025-57753 Source advisory:...

declarative-js (>=0.0.0, <=0.0.2) potentially affected by unknown CVE via andthen (0.0.2)

andthen NPM version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on andthen and may be impacted: - declarative-js =0.0.0, =0.0.2 Source cves: unknown CVE Source advisory: OSV:MAL-2025-14514...