@arenahito/droid-webscr (>=0.2.1, <=0.6.1), @cappa/cli (>=0.4.4, <=0.10.4) +2 more potentially affected by CVE-2026-14198 via @fastify/middie (>=9.1.0, <=9.3.2)

@fastify/middie NPM version =9.1.0, =0.2.1, =0.4.4, =0.2.8, =1.0.0-alpha.23, =1.0.0-alpha.28 Source cves: CVE-2026-14198 Source advisory: MEND:CVE-2026-14198...

@depup/electron-builder (26.8.1-depup.0), @lynx-js/lynxtron-builder (>=0.0.0-alpha.0, <=0.0.30) +8 more potentially affected by CVE-2026-54672 via app-builder-lib (>=26.0.0-alpha.0, <=26.14.0)

app-builder-lib NPM version =26.0.0-alpha.0, =0.0.0-alpha.0, =26.8.2-beta.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.14.0 Source cves: CVE-2026-54672 Source advisory: SNYK:JS-APPBUILDERLIB-17744441...

0.edsql.electronapp (1.0.65), @abcum/electron-updater (>=0.1.0, <=0.1.2) +598 more potentially affected by CVE-2026-54673 via builder-util-runtime (>=0.0.0-semantic-release, <=9.6.3)

builder-util-runtime NPM version =0.0.0-semantic-release, =0.1.0, =0.1.0, =3.0.5, =0.1.0, =1.9.0, =1.1.0, =22.6.1-1, =1.0.4, =1.0.0, =0.0.10, =0.0.1, =26.0.11-2, =6.6.2-2, =0.0.1, =1.0.3 and more Source cves: CVE-2026-54673 Source advisory: MEND:CVE-2026-54673...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +640 more potentially affected by CVE-2026-57204 via pypdf (>=3.1.0, <=6.13.2)

pypdf PYPI version =3.1.0, =0.1.1, =0.9.1, =0.0.2, =0.0.1, =0.1.0, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =0.0.1, =0.1.0 and more Source cves: CVE-2026-57204 Source advisory: MEND:CVE-2026-57204...

pycham (>=2.1.3, <=2.1.7) potentially affected by CVE-2025-10996 via openbabel (2.4.0)

openbabel PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on openbabel and may be impacted: - pycham =2.1.3, =2.1.7 Source cves: CVE-2025-10996 Source advisory: OSV:GHSA-J35X-W4GJ-PF7W...

bcforms (>=0.0.2, <=0.0.8), bpforms (>=0.0.12, <=0.0.15) +1 more potentially affected by CVE-2025-10995 via openbabel (2.4.1)

openbabel PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on openbabel and may be impacted: - bcforms =0.0.2, =0.0.12, =0.1.0, =0.6.1 Source cves: CVE-2025-10995 Source advisory: OSV:GHSA-8J3X-M868-CPW8...

pycham (>=2.1.3, <=2.1.7) potentially affected by CVE-2026-2705 via openbabel (2.4.0)

openbabel PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on openbabel and may be impacted: - pycham =2.1.3, =2.1.7 Source cves: CVE-2026-2705 Source advisory: OSV:GHSA-4W5W-4FHM-Q483...

bcforms (>=0.0.2, <=0.0.8), bpforms (>=0.0.12, <=0.0.15) +1 more potentially affected by CVE-2026-2705 via openbabel (2.4.1)

openbabel PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on openbabel and may be impacted: - bcforms =0.0.2, =0.0.12, =0.1.0, =0.6.1 Source cves: CVE-2026-2705 Source advisory: OSV:GHSA-4W5W-4FHM-Q483...

@bedrock/express (8.6.5), @cmmn/tools (>=3.0.0-alpha-1, <=3.0.0-alpha-6) +1 more potentially affected by CVE-2026-6556 via @fastify/express (>=4.0.1, <=4.0.5)

@fastify/express NPM version =4.0.1, =3.0.0-alpha-1, =3.0.0-alpha-6 - mikr0 0.1.10 Source cves: CVE-2026-6556 Source advisory: SNYK:JS-FASTIFYEXPRESS-17744444...

CVE-2026-13149

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

@activepieces/piece-google-gemini (0.1.6), @activepieces/piece-google-vertexai (0.1.2) +8 more potentially affected by CVE-2026-13149 via brace-expansion (>=2.0.0, <=2.0.2)

brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-13149 Source advisory: SNYK:JS-BRACEEXPANSION-17706650...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +28 more potentially affected by CVE-2026-13149 via brace-expansion (>=1.1.0, <=1.1.13)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.3, =0.1.0 and more Source cves: CVE-2026-13149 Source advisory: SNYK:JS-BRACEEXPANSION-17706650...

03-gs-ee-6 (0.3.5), @albgen/capacitor-escpos-plugin (>=0.0.4, <=1.0.1) +2934 more potentially affected by CVE-2026-13149 via brace-expansion (>=3.0.0, <=5.0.6)

brace-expansion NPM version =3.0.0, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 - @angranit/phantompirs 0.1.0 -...

be.yildiz-games:module-messaging-activemq (>=1.0.0, <=1.0.1), cn.codeforfun:jfinal-activemq (0.3) +334 more potentially affected by CVE-2026-49434 via org.apache.activemq:activemq-all (>=4.1.2, <=5.19.7)

org.apache.activemq:activemq-all MAVEN version =4.1.2, =1.0.0, =6.0.03, =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =2.0.3-rc1, =2.0.0-rc2, =1.1.6, =8.0.0-beta1, =2.0.0, =2.3.0 - com.freedomotic:base-objects 3.0 - com.freedomotic:essential 3.0 - com.freedomotic:freedomotic-core 5.6 and more...

org.apache.axis2:axis2-integration (1.4), org.apache.camel:camel-example-cxf (>=1.2.0, <=1.3.0) +3 more potentially affected by CVE-2026-49432 via org.apache.activemq:apache-activemq (>=4.1.1, <=5.0.0)

org.apache.activemq:apache-activemq MAVEN version =4.1.1, =1.2.0, =1.1.0, =1.3.0 - org.apache.camel:camel-example-spring 1.2.0 - org.apache.camel:camel-example-spring-xquery 1.3.0 Source cves: CVE-2026-49432 Source advisory: MEND:CVE-2026-49432...

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +1511 more potentially affected by CVE-2026-50734 via org.apache.activemq:activemq-client (>=5.8.0, <=5.19.7)

org.apache.activemq:activemq-client MAVEN version =5.8.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2026-50734 Source advisory: MEND:CVE-2026-50734...

be.yildiz-games:module-messaging-activemq (2.0.0), com.codbex.atlas:codbex-atlas-application (>=1.1.0, <=14.90.0) +120 more potentially affected by CVE-2026-53917 via org.apache.activemq:activemq-broker (>=6.0.0, <=6.2.6)

org.apache.activemq:activemq-broker MAVEN version =6.0.0, =1.1.0, =2.55.0, =1.0.5, =1.1.0, =1.1.0, =1.1.0, =0.2.0, =1.1.0, =5.0.0, =0.2.2, =1.4.0, =2.5.0 and more Source cves: CVE-2026-53917 Source advisory: MEND:CVE-2026-53917...

be.yildiz-games:module-messaging-activemq (2.0.0), com.codbex.atlas:codbex-atlas-application (>=1.1.0, <=14.90.0) +120 more potentially affected by CVE-2026-54475 via org.apache.activemq:activemq-broker (>=6.0.0, <=6.2.6)

org.apache.activemq:activemq-broker MAVEN version =6.0.0, =1.1.0, =2.55.0, =1.0.5, =1.1.0, =1.1.0, =1.1.0, =0.2.0, =1.1.0, =5.0.0, =0.2.2, =1.4.0, =2.5.0 and more Source cves: CVE-2026-54475 Source advisory: MEND:CVE-2026-54475...

03-gs-ee-6 (0.3.5), @albgen/capacitor-escpos-plugin (>=0.0.4, <=1.0.1) +2934 more potentially affected by CVE-2026-13149 via brace-expansion (>=3.0.0, <=5.0.6)

brace-expansion NPM version =3.0.0, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 - @angranit/phantompirs 0.1.0 -...

annotald (>=1.3.1, <=1.3.7) potentially affected by CVE-2026-12243 via nltk (2.0.4)

nltk PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on nltk and may be impacted: - annotald =1.3.1, =1.3.7 Source cves: CVE-2026-12243 Source advisory: OSV:PYSEC-2026-597...