10minions-engine (>=0.0.1 <=0.0.4), @1amageek/document-propagator (>=0.10.1 <=1.0.0) +1530 more potentially affected by CVE-2026-42290 via protobufjs-cli (>=1.0.0 <=1.1.3)

protobufjs-cli NPM version =1.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2026-42290 Source advisory: SNYK:JS-PROTOBUFJSCLI-16643433...

@squawk/airports (>=0.2.0 <=0.6.1), @squawk/airspace (>=0.2.3 <=0.8.0) +7 more potentially affected by unknown CVE via @squawk/units (=0.4.2)

@squawk/units NPM version =0.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on @squawk/units and may be impacted: - @squawk/airports =0.2.0, =0.2.3, =0.2.0, =0.1.0, =0.2.0, =0.3.0, =0.2.0, =0.2.0, =0.2.0, =0.4.1 Source cves: unknown CVE Source...

@ardeora/start-devtools (>=1.0.0 <=1.0.1), @carvajalconsultants/headstart (>=1.0.0 <=1.0.2) +26 more potentially affected by CVE-2026-45321 via @tanstack/virtual-file-routes (>=1.121.0-alpha.28 <=1.154.7)

@tanstack/virtual-file-routes NPM version =1.121.0-alpha.28, =1.0.0, =1.0.0, =0.1.0, =1.20.3-alpha.1, =1.111.10, =1.130.0, =1.121.0-alpha.28, =1.121.0-alpha.28, =1.121.0-alpha.28, =1.121.0-alpha.28, =1.20.3-alpha.1, =1.114.29, =1.130.0, =1.97.4, =1.120.20 and more Source cves: CVE-2026-45321 Sour...

@d-trattner/pidex (>=0.1.1 <=0.1.3), birdclaw (>=0.1.0 <=0.7.0) +1 more potentially affected by CVE-2026-45321 via @tanstack/react-start (>=1.167.2 <=1.167.65)

@tanstack/react-start NPM version =1.167.2, =0.1.1, =0.1.0, =0.0.0-dev, =0.23.0 Source cves: CVE-2026-45321 Source advisory: SNYK:JS-TANSTACKREACTSTART-16640215...

@agentionai/agents (>=0.11.0 <=0.13.0), @andreafspeziale/nestjs-search (>=2.0.0 <=2.0.1) +80 more potentially affected by unknown CVE via @opensearch-project/opensearch (>=3.2.0 <=3.6.0)

@opensearch-project/opensearch NPM version =3.2.0, =0.11.0, =2.0.0, =1.8.0, =3.0.17, =1.0.84, =0.1.0, =1.0.0, =1.0.1, =0.1.0, =0.2.3 - @fastify/opensearch =2.0.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-OPENSEARCHPROJECTOPENSEARCH-16640915...

org.webjars.npm:autobahn (=0.11.2), org.webjars.npm:blockly (>=9.3.2 <=10.4.1) +17 more potentially affected by CVE-2026-45736 via org.webjars.npm:ws (>=8.11.0 <=8.2.3)

org.webjars.npm:ws MAVEN version =8.11.0, =9.3.2, =6.2.1, =6.2.1, =0.19.11, =0.2.11, =21.1.1, =22.1.0 - org.webjars.npm:nestjsplatform-socket.io =9.0.0-next.2 and more Source cves: CVE-2026-45736 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16722636...

@ardeora/start-devtools (>=1.0.0 <=1.0.1), @brendonovich/solidjs__start (>=0.0.0 <=0.0.3) +39 more potentially affected by CVE-2026-45321 via @tanstack/router-utils (>=1.121.0-alpha.28 <=1.158.0)

@tanstack/router-utils NPM version =1.121.0-alpha.28, =1.0.0, =0.0.0, =1.0.0, =1.0.0, =1.0.11, =0.1.0, =1.1.0, =1.121.0-alpha.28, =1.20.3-alpha.1, =1.111.10, =1.20.3-alpha.1, =1.111.10, =1.111.10, =1.121.0-alpha.28, =1.161.3 and more Source cves: CVE-2026-45321 Source advisory:...

@ardeora/start-devtools (>=1.0.0 <=1.0.1), @carvajalconsultants/headstart (>=1.0.0 <=1.0.2) +33 more potentially affected by CVE-2026-45321 via @tanstack/router-generator (>=1.10.0 <=1.166.42)

@tanstack/router-generator NPM version =1.10.0, =1.0.0, =1.0.0, =0.1.1, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =1.20.3-alpha.1, =1.111.10, =1.121.23, =0.0.1, =1.10.0, =1.121.0-alpha.28, =1.167.35 and more Source cves: CVE-2026-45321 Source advisory: SNYK:JS-TANSTACKROUTERGENERATOR-16640221...

@antidrawapp/runtime (>=0.1.0 <=0.1.1), @ardeora/start-devtools (>=1.0.0 <=1.0.1) +91 more potentially affected by CVE-2026-45321 via @tanstack/history (>=1.0.0 <=1.15.13)

@tanstack/history NPM version =1.0.0, =0.1.0, =1.0.0, =0.6.2, =0.6.2, =0.1.1, =0.1.1, =0.6.2, =0.2.2, =0.3.0, =0.6.0, =0.2.2, =1.0.0, =1.0.9, =0.1.2-beta.1, =0.1.2-beta.10 - @env-hopper/frontend-build-vite =2.0.1-alpha.0 and more Source cves: CVE-2026-45321 Source advisory:...

-fides-amor-et-lux (=1.0.0), -price-checker (>=1.0.0 <=1.0.5) +35597 more potentially affected by CVE-2026-45736 via ws (>=8.0.0 <=8.20.0)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =1.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vibekit =0.1.0 - 0g-zksettlement-client =1.0.0 and more Source cves: CVE-2026-45736 Source advisory: SNYK:JS-WS-16722635...

@ardeora/start-devtools (>=1.0.0 <=1.0.1), @carvajalconsultants/headstart (>=1.0.0 <=1.0.2) +39 more potentially affected by CVE-2026-45321 via @tanstack/start-storage-context (>=1.121.0-alpha.28 <=1.166.4)

@tanstack/start-storage-context NPM version =1.121.0-alpha.28, =1.0.0, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =1.20.3-alpha.1, =1.121.0-alpha.28, =1.111.10, =1.129.0, =0.0.1, =1.121.0-alpha.28, =1.20.3-alpha.1, =1.121.0-alpha.28, =1.114.29, =1.129.0, =1.131.50 and more Source cves: CVE-2026-45321 Source...

@8btc/excalidraw (>=0.18.0-beta.0 <=0.18.0-beta.4), @airmix/mcp-excalidraw-server (=1.0.6) +252 more potentially affected by CVE-2026-41149 via mermaid (>=0.2.16 <=10.9.5)

mermaid NPM version =0.2.16, =0.18.0-beta.0, =0.17.0-alkemio-1, =1.0.0, =0.18.3, =0.18.0, =0.0.1-BETA, =0.18.1, =1.1.4, =0.17.1, =0.0.19, =3.0.0, =0.0.12, =1.0.1, =1.5.0-rc3 and more Source cves: CVE-2026-41149 Source advisory: SNYK:JS-MERMAID-16642050...

a2 (>=0.1.0 <=0.3.17), abadpour (>=6.13.1 <=7.24.1) +952 more potentially affected by CVE-2026-2393 via mlflow (>=0.8.2 <=3.8.1)

mlflow PYPI version =0.8.2, =0.1.0, =6.13.1, =9.273.1, =1.1.0, =0.1.0, =0.1.0, =0.4.4, =0.3.0, =0.0.5, =1.0.0, =0.1.0, =1.1.1 - ai-helpers-pytorch-utils =0.1.0a1 - ailine-core =0.5.5 and more Source cves: CVE-2026-2393 Source advisory: OSV:GHSA-65H7-C7C4-MGHX...

aigco (=0.0.3), airoboros (>=2.1.6 <=2.2.1) +81 more potentially affected by CVE-2026-31253 via flash-attn (>=0.2.8 <=2.8.3)

flash-attn PYPI version =0.2.8, =2.1.6, =1.1.2, =0.0.0.dev0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.3, =0.1.0, =0.0.7rc14, =0.0.1, =0.0.8 and more Source cves: CVE-2026-31253 Source advisory: OSV:GHSA-7G5W-PQ96-8C5W...

agent-context-packager (>=0.3.0 <=0.3.3), agentcrew-ai (>=0.6.0 <=0.6.11.post2) +229 more potentially affected by CVE-2026-31248 via docling (>=1.11.0 <=2.55.0)

docling PYPI version =1.11.0, =0.3.0, =0.6.0, =0.1.4, =0.3.2, =0.2.5, =0.4.0, =0.2.0, =26.5.333, =0.0.2, =1.0.3, =1.0.0, =1.0.3 - bidkit-parser =0.1.0 and more Source cves: CVE-2026-31248 Source advisory: OSV:GHSA-9F4Q-Q82Q-4359...

agent-context-packager (>=0.3.0 <=0.3.3), agentcrew-ai (>=0.6.0 <=0.6.11.post2) +229 more potentially affected by CVE-2026-31247 via docling (>=1.11.0 <=2.55.0)

docling PYPI version =1.11.0, =0.3.0, =0.6.0, =0.1.4, =0.3.2, =0.2.5, =0.4.0, =0.2.0, =26.5.333, =0.0.2, =1.0.3, =1.0.0, =1.0.3 - bidkit-parser =0.1.0 and more Source cves: CVE-2026-31247 Source advisory: OSV:GHSA-CR42-RG2M-MQ4Q...

11x-wagtail-blog (>=0.0.0 <=0.2.0), adede (=4.1.0) +202 more potentially affected by CVE-2026-44201 via wagtail (>=1.0.0 <=7.0.0)

wagtail PYPI version =1.0.0, =0.0.0, =0.57.1, =0.1.0a0.dev0, =4.1.0, =4.3.0, =2.28.0, =0.5.0, =0.3.1, =6.3.8 and more Source cves: CVE-2026-44201 Source advisory: OSV:PYSEC-2026-150...

aratinga (=0.1.0a0.dev3), coop (>=7.1.0 <=7.2.1) +7 more potentially affected by CVE-2026-44200 via wagtail (>=7.1.0 <=7.2.3)

wagtail PYPI version =7.1.0, =7.1.0, =1.1.1, =2.0.0, =0.0.1, =7.1.0a1, =7.2.0b0 Source cves: CVE-2026-44200 Source advisory: OSV:PYSEC-2026-149...

aratinga (=0.1.0a0.dev3), coop (>=7.1.0 <=7.2.1) +7 more potentially affected by CVE-2026-44199 via wagtail (>=7.1.0 <=7.2.3)

wagtail PYPI version =7.1.0, =7.1.0, =1.1.1, =2.0.0, =0.0.1, =7.1.0a1, =7.2.0b0 Source cves: CVE-2026-44199 Source advisory: OSV:PYSEC-2026-148...

aratinga (=0.1.0a0.dev3), coop (>=7.1.0 <=7.2.1) +7 more potentially affected by CVE-2026-44197 via wagtail (>=7.1.0 <=7.2.3)

wagtail PYPI version =7.1.0, =7.1.0, =1.1.1, =2.0.0, =0.0.1, =7.1.0a1, =7.2.0b0 Source cves: CVE-2026-44197 Source advisory: OSV:PYSEC-2026-146...