@knocklabs/client (>=0.21.6, <=0.22.1), @knocklabs/expo (>=0.5.0, <=0.6.9) +8 more potentially affected by CVE-2026-56812 via phoenix (>=1.8.0, <=1.8.7)

phoenix NPM version =1.8.0, =0.21.6, =0.5.0, =0.11.0, =0.13.0, =0.8.0, =0.0.2, =0.0.1, =0.0.2, =0.0.1, =2.1.8, =2.5.4 Source cves: CVE-2026-56812 Source advisory: OSV:GHSA-63MC-HW7G-86RR...

@absinthe/graphql-playground (>=1.3.1, <=1.3.5), @absinthe/socket (>=0.1.0, <=0.2.0) +52 more potentially affected by CVE-2026-56812 via phoenix (>=1.3.0, <=1.5.12)

phoenix NPM version =1.3.0, =1.3.1, =0.1.0, =0.1.2, =0.1.0, =0.1.2, =1.7.5, =1.5.1, =1.7.5, =1.8.1, =1.0.0, =1.5.6, =1.8.1, =1.8.1, =1.7.26, =1.7.26, =1.16.6-beta-eaa4d39d and more Source cves: CVE-2026-56812 Source advisory: OSV:GHSA-63MC-HW7G-86RR...

1xn-vmcp (>=0.1.0, <=0.6.1), a2 (>=0.1.0, <=0.8.3) +2072 more potentially affected by CVE-2024-33663 +1 more via python-jose (>=0.5.5, <=3.5.0)

python-jose PYPI version =0.5.5, =0.1.0, =0.1.0, =0.3.6, =0.1.0a1, =0.1.2b0, =0.0.1a1, =0.1.0, =0.1.1, =3.1.0b1, =0.0.3, =1.0.3, =0.1.0a0, =1.0.0, =0.0.1a2, =3.2.0 and more Source cves: CVE-2024-33663, CVE-2026-85394 Source advisory: SNYK:PYTHON-PYTHONJOSE-19639037...

org.webjars.npm:github-com-cisco-node-jose (2.2.0), org.webjars.npm:google-auth-library (>=1.6.1, <=6.1.6) +7 more potentially affected by CVE-2026-33894 +1 more via org.webjars.npm:node-forge (>=0.7.1, <=1.3.3)

org.webjars.npm:node-forge MAVEN version =0.7.1, =1.6.1, =1.0.2, =2.3.2, =1.10.2, =2.1.1 Source cves: CVE-2026-33894, CVE-2026-85393 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-19635205...

7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +2036 more potentially affected by CVE-2026-63670 via sanitize-html (>=2.1.0, <=2.17.5)

sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =5.0.2, =0.0.1, =1.0.0, =3.0.0, =1.3.0, =1.0.0, =1.38.0, =1.3.2, =1.7.1 and more Source cves: CVE-2026-63670 Source advisory: OSV:GHSA-JXWJ-J7WR-GFRW...

@apify/actors-mcp-server (>=0.10.13-beta.4, <=0.11.6-beta.2), @barney-media/crap-typescript-core (>=0.5.0, <=0.5.1) +63 more potentially affected by CVE-2026-82404 via @toon-format/toon (>=2.1.0, <=2.3.0)

@toon-format/toon NPM version =2.1.0, =0.10.13-beta.4, =0.5.0, =0.1.0, =0.0.232, =0.0.232, =0.0.232, =1.7.0, =0.1.0, =0.1.0, =8.1.0, =8.1.0, =8.1.0, =8.1.0, =8.1.0, =8.7.10 and more Source cves: CVE-2026-82404 Source advisory: OSV:GHSA-P95V-992W-H6C3...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71867 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-71867 Source advisory: OSV:GHSA-2W86-XFRC-G85R...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71865 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-71865 Source advisory: OSV:GHSA-653Q-5476-X79G...

@agiflowai/aicode-toolkit (>=1.2.0, <=1.3.0), @agiflowai/one-mcp (>=0.4.1, <=0.4.2) +30 more potentially affected by CVE-2026-61556 via liquidjs (>=10.26.0, <=10.27.0)

liquidjs NPM version =10.26.0, =1.2.0, =0.4.1, =1.2.0, =1.1.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =36.0.0-rc.0, =0.0.1-beta.0, =3.0.0, =0.5.0, =0.3024.0, =0.3024.0, =1.1.1 and more Source cves: CVE-2026-61556 Source advisory: OSV:GHSA-M7FP-H3P4-HR49...

@cedarjs/api-server (>=1.0.0-canary.12281, <=9.0.0-canary.1784), @cedarjs/api-server-watch (>=5.0.7-next.219, <=7.0.0-canary.3116) +41 more potentially affected by CVE-2026-85124 via @fastify/http-proxy (>=11.1.2, <=11.6.1)

@fastify/http-proxy NPM version =11.1.2, =1.0.0-canary.12281, =5.0.7-next.219, =1.0.0-canary.12281, =5.0.4-next.167, =1.0.0-canary.12281, =1.0.0-canary.12281, =4.0.0-canary.13864, =4.0.0-canary.13864, =1.0.0-canary.12281, =3.0.0-alpha-1, =0.0.4, =0.3.0, =0.1.0, =0.4.22 and more Source cves:...

@argustech/agentflow (>=1.0.0, <=1.4.0), @assisly-orgnazation/embed (0.1.0) +37 more potentially affected by CVE-2026-68921 via @dicebear/initials (>=9.0.0, <=9.4.2)

@dicebear/initials NPM version =9.0.0, =1.0.0, =9.0.0, =18.0.0, =1.0.9, =0.0.4, =1.1.2, =1.4.0, =1.0.2, =4.2.12, =21.0.30, =0.0.1, =0.0.153 and more Source cves: CVE-2026-68921 Source advisory: OSV:GHSA-GCR2-9V8M-GQ45...

@djangocfg/widget-avatar (>=0.1.1, <=0.1.9), @fduenascoink/ui-sdk (>=18.0.0, <=18.0.4) +4 more potentially affected by CVE-2026-68921 via @dicebear/core (>=9.0.0, <=9.4.2)

@dicebear/core NPM version =9.0.0, =0.1.1, =18.0.0, =0.1.0-alpha.1, =0.0.119, =0.1.0, =9.0.0, =9.4.2 Source cves: CVE-2026-68921 Source advisory: OSV:GHSA-GCR2-9V8M-GQ45...

@leviyuan/lodestar (>=0.17.1, <=0.19.5), @openai/codex-security (>=0.1.26, <=0.1.27) +6 more potentially affected by CVE-2026-84394 via fast-uri (3.1.6)

fast-uri NPM version 3.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on fast-uri and may be impacted: - @leviyuan/lodestar =0.17.1, =0.1.26, =0.55.0-beta.11, =0.55.0-beta.11, =0.55.0-beta.11, =1.4.35, =0.1.13, =4.7.12, =4.7.14 Source cves:...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +30 more potentially affected by CVE-2026-84292 via fast-uri (>=3.0.1, <=3.1.6)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.4.2, =1.2.0, =0.17.1, =5.4.3, =0.2.0-alpha.5, =0.1.0, =0.55.0-beta.11, =0.55.0-beta.15 and more Source cves: CVE-2026-84292 Source advisory: SNYK:JS-FASTURI-19502739...

@datastream/validate (>=0.0.4, <=0.0.38), @dearmrzhang/customs-mcp-server (>=0.1.2, <=1.1.0) +15 more potentially affected by CVE-2026-84292 via fast-uri (>=2.1.0, <=2.3.0)

fast-uri NPM version =2.1.0, =0.0.4, =0.1.2, =0.0.1, =0.0.1, =3.1.0-rc.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.0, =1.0.0, =3.0.0, =1.7.0, =1.8.0 and more Source cves: CVE-2026-84292 Source advisory: SNYK:JS-FASTURI-19502739...

@kaikybrofc/zyra (0.2.4) potentially affected by CVE-2026-61704 via link-preview-js (4.0.3)

link-preview-js NPM version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on link-preview-js and may be impacted: - @kaikybrofc/zyra 0.2.4 Source cves: CVE-2026-61704 Source advisory: OSV:GHSA-CPJF-6666-R8FX...

@apisurf/canonui (>=0.1.1, <=0.1.4), @apisurf/deckui (>=0.1.1, <=0.1.2) +14 more potentially affected by CVE-2026-84376 via astro (>=7.0.2, <=7.2.2)

astro NPM version =7.0.2, =0.1.1, =0.1.1, =3.1.0, =0.4.9, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-84376 Source advisory: SNYK:JS-ASTRO-19643569...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +24 more potentially affected by CVE-2026-75975 via fast-uri (>=3.0.1, <=3.1.5)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.4.2, =1.2.0, =5.4.3, =0.2.0-alpha.5, =0.1.0, =1.0.0, =1.0.0, =1.0.4 and more Source cves: CVE-2026-75975 Source advisory: OSV:GHSA-F65P-4M7J-42XC...

@diviops/mcp-server (>=1.5.40, <=1.5.43), @donadiosolutions/lcm (>=1.4.2, <=1.4.3) +18 more potentially affected by CVE-2026-75899 via fast-uri (>=3.1.2, <=3.1.5)

fast-uri NPM version =3.1.2, =1.5.40, =1.4.2, =1.2.0, =0.2.0-alpha.5, =0.1.0, =0.1.6, =1.25.0, =0.1.5, =3.38.11, =3.39.0 and more Source cves: CVE-2026-75899 Source advisory: OSV:GHSA-FPH4-WMHF-6FWF...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +24 more potentially affected by CVE-2026-76172 via fast-uri (>=3.0.1, <=3.1.5)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.4.2, =1.2.0, =5.4.3, =0.2.0-alpha.5, =0.1.0, =1.0.0, =1.0.0, =1.0.4 and more Source cves: CVE-2026-76172 Source advisory: OSV:GHSA-JQFF-G426-HQXP...