@tanstack/solid-start (>=1.121.0-alpha.28 <=1.167.62) potentially affected by CVE-2026-45321 via @tanstack/solid-start-server (>=1.121.0-alpha.28 <=1.166.51)

@tanstack/solid-start-server NPM version =1.121.0-alpha.28, =1.121.0-alpha.28, =1.167.62 Source cves: CVE-2026-45321 Source advisory: SNYK:JS-TANSTACKSOLIDSTARTSERVER-16640235...

@2digits/eslint-config (>=4.10.0 <=5.1.10), @yunarch/config-web (>=0.1.0 <=0.7.6) potentially affected by CVE-2026-45321 via @tanstack/eslint-plugin-router (>=1.115.0 <=1.155.0)

@tanstack/eslint-plugin-router NPM version =1.115.0, =4.10.0, =0.1.0, =0.7.6 Source cves: CVE-2026-45321 Source advisory: SNYK:JS-TANSTACKESLINTPLUGINROUTER-16640202...

@env-hopper/frontend-build-vite (=2.0.1-alpha.0), @ibootz/claude-code-viewer (>=0.7.5 <=0.8.2) +11 more potentially affected by CVE-2026-45321 via @tanstack/router-devtools-core (>=1.120.19 <=1.167.3)

@tanstack/router-devtools-core NPM version =1.120.19, =0.7.5, =0.4.2, =0.0.1, =1.121.0-alpha.28, =1.121.0-alpha.28, =1.121.0-alpha.28, =1.140.0, =0.1.0, =0.0.0-dev, =0.23.0 Source cves: CVE-2026-45321 Source advisory: SNYK:JS-TANSTACKROUTERDEVTOOLSCORE-16640219...

@tanstack/vue-start (>=1.141.0 <=1.167.58) potentially affected by CVE-2026-45321 via @tanstack/vue-start-client (>=1.141.0 <=1.166.43)

@tanstack/vue-start-client NPM version =1.141.0, =1.141.0, =1.167.58 Source cves: CVE-2026-45321 Source advisory: SNYK:JS-TANSTACKVUESTARTCLIENT-16640254...

@antidrawapp/runtime (>=0.1.0 <=0.1.1), @ardeora/start-devtools (>=1.0.0 <=1.0.1) +91 more potentially affected by CVE-2026-45321 via @tanstack/history (>=1.0.0 <=1.15.13)

@tanstack/history NPM version =1.0.0, =0.1.0, =1.0.0, =0.6.2, =0.6.2, =0.1.1, =0.1.1, =0.6.2, =0.2.2, =0.3.0, =0.6.0, =0.2.2, =1.0.0, =1.0.9, =0.1.2-beta.1, =0.1.2-beta.10 - @env-hopper/frontend-build-vite =2.0.1-alpha.0 and more Source cves: CVE-2026-45321 Source advisory:...

@d-trattner/pidex (>=0.1.1 <=0.1.3), @tanstack/react-start (>=1.167.21 <=1.167.65) +1 more potentially affected by CVE-2026-45321 via @tanstack/react-start-rsc (>=0.0.1 <=0.0.5)

@tanstack/react-start-rsc NPM version =0.0.1, =0.1.1, =1.167.21, =0.1.0, =0.7.0 Source cves: CVE-2026-45321 Source advisory: SNYK:JS-TANSTACKREACTSTARTRSC-16640211...

@d-trattner/pidex (>=0.1.1 <=0.1.3), @tanstack/react-start (>=1.121.0-alpha.28 <=1.167.65) +3 more potentially affected by CVE-2026-45321 via @tanstack/react-start-server (>=1.121.0-alpha.28 <=1.166.52)

@tanstack/react-start-server NPM version =1.121.0-alpha.28, =0.1.1, =1.121.0-alpha.28, =0.0.1, =0.1.0, =0.0.0-dev, =0.23.0 Source cves: CVE-2026-45321 Source advisory: SNYK:JS-TANSTACKREACTSTARTSERVER-16640213...

@squawk/mcp (>=0.2.0 <=0.9.0) potentially affected by unknown CVE via @squawk/procedure-data (>=0.3.3 <=0.7.2)

@squawk/procedure-data NPM version =0.3.3, =0.2.0, =0.9.0 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKPROCEDUREDATA-16640883...

@squawk/mcp (>=0.4.1 <=0.8.1) potentially affected by unknown CVE via @squawk/airspace-data (>=0.3.2 <=0.4.0)

@squawk/airspace-data NPM version =0.3.2, =0.4.1, =0.8.1 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKAIRSPACEDATA-16640882...

@squawk/mcp (=0.4.1) potentially affected by unknown CVE via @squawk/notams (=0.2.3)

@squawk/notams NPM version =0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on @squawk/notams and may be impacted: - @squawk/mcp =0.4.1 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKNOTAMS-16640886...

-fides-amor-et-lux (=1.0.0), -price-checker (>=1.0.0 <=1.0.5) +35597 more potentially affected by CVE-2026-45736 via ws (>=8.0.0 <=8.20.0)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =1.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vibekit =0.1.0 - 0g-zksettlement-client =1.0.0 and more Source cves: CVE-2026-45736 Source advisory: SNYK:JS-WS-16722635...

@squawk/mcp (>=0.4.1 <=0.8.1) potentially affected by unknown CVE via @squawk/airway-data (>=0.3.3 <=0.4.2)

@squawk/airway-data NPM version =0.3.3, =0.4.1, =0.8.1 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKAIRWAYDATA-16640895...

@squawk/mcp (>=0.4.1 <=0.6.0) potentially affected by unknown CVE via @squawk/weather (>=0.3.4 <=0.4.1)

@squawk/weather NPM version =0.3.4, =0.4.1, =0.6.0 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKWEATHER-16640874...

@squawk/mcp (>=0.4.1 <=0.8.1) potentially affected by unknown CVE via @squawk/airport-data (>=0.4.1 <=0.6.1)

@squawk/airport-data NPM version =0.4.1, =0.4.1, =0.8.1 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKAIRPORTDATA-16640876...

org.webjars.npm:autobahn (=0.11.2), org.webjars.npm:blockly (>=9.3.2 <=10.4.1) +17 more potentially affected by CVE-2026-45736 via org.webjars.npm:ws (>=8.11.0 <=8.2.3)

org.webjars.npm:ws MAVEN version =8.11.0, =9.3.2, =6.2.1, =6.2.1, =0.19.11, =0.2.11, =21.1.1, =22.1.0 - org.webjars.npm:nestjsplatform-socket.io =9.0.0-next.2 and more Source cves: CVE-2026-45736 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16722636...

@squawk/mcp (>=0.4.1 <=0.8.1) potentially affected by unknown CVE via @squawk/navaid-data (>=0.4.1 <=0.5.2)

@squawk/navaid-data NPM version =0.4.1, =0.4.1, =0.8.1 Source cves: unknown CVE Source advisory: SNYK:JS-SQUAWKNAVAIDDATA-16640894...

@8btc/excalidraw (>=0.18.0-beta.0 <=0.18.0-beta.4), @airmix/mcp-excalidraw-server (=1.0.6) +252 more potentially affected by CVE-2026-41149 via mermaid (>=0.2.16 <=10.9.5)

mermaid NPM version =0.2.16, =0.18.0-beta.0, =0.17.0-alkemio-1, =1.0.0, =0.18.3, =0.18.0, =0.0.1-BETA, =0.18.1, =1.1.4, =0.17.1, =0.0.19, =3.0.0, =0.0.12, =1.0.1, =1.5.0-rc3 and more Source cves: CVE-2026-41149 Source advisory: SNYK:JS-MERMAID-16642050...

aigco (=0.0.3), airoboros (>=2.1.6 <=2.2.1) +81 more potentially affected by CVE-2026-31253 via flash-attn (>=0.2.8 <=2.8.3)

flash-attn PYPI version =0.2.8, =2.1.6, =1.1.2, =0.0.0.dev0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.3, =0.1.0, =0.0.7rc14, =0.0.1, =0.0.8 and more Source cves: CVE-2026-31253 Source advisory: OSV:GHSA-7G5W-PQ96-8C5W...

azure-ai-generative (>=1.0.0b1 <=1.0.0b3), azure-ai-resources (>=1.0.0b1 <=1.0.0b9) +15 more potentially affected by CVE-2026-2393 via mlflow-skinny (>=3.0.0 <=3.0.1)

mlflow-skinny PYPI version =3.0.0, =1.0.0b1, =1.0.0b1, =0.1.0, =0.1.0, =2.5.0, =0.0.13, =3.0.0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-2393 Source advisory: SNYK:PYTHON-MLFLOWSKINNY-16642072...

@elliemae/pui-e2e-test-sdk (>=11.0.0 <=12.2.0), froth-webdriverio-framework (>=9.0.5-ytlc3.0 <=9.0.5-ytlc7.0) potentially affected by CVE-2026-25244 via @wdio/browserstack-service (>=9.12.7 <=9.23.0)

@wdio/browserstack-service NPM version =9.12.7, =11.0.0, =9.0.5-ytlc3.0, =9.0.5-ytlc7.0 Source cves: CVE-2026-25244 Source advisory: SNYK:JS-WDIOBROWSERSTACKSERVICE-16642116...