@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +22 more potentially affected by CVE-2026-92953 via vm2 (>=3.11.1, <=3.11.6)

vm2 NPM version =3.11.1, =3.0.57, =0.1.0, =2.32.0, =0.0.16, =1.4.13, =1.0.0, =1.1.0, =0.2.0, =1.0.0, =3.1.3, =2.32.0, =1.72.3, =2.0.9 and more Source cves: CVE-2026-92953 Source advisory: OSV:GHSA-3VGF-8M4Q-Q4QR...

@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +22 more potentially affected by CVE-2026-92936 via vm2 (>=3.11.1, <=3.11.6)

vm2 NPM version =3.11.1, =3.0.57, =0.1.0, =2.32.0, =0.0.16, =1.4.13, =1.0.0, =1.1.0, =0.2.0, =1.0.0, =3.1.3, =2.32.0, =1.72.3, =2.0.9 and more Source cves: CVE-2026-92936 Source advisory: OSV:GHSA-X6M4-CHR9-CG97...

@dataform/cli (>=3.0.59-alpha.1, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92952 via vm2 (>=3.11.4, <=3.11.6)

vm2 NPM version =3.11.4, =3.0.59-alpha.1, =0.1.0, =2.32.0, =1.8.2, =1.1.0, =0.2.0, =2.32.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.74.12 and more Source cves: CVE-2026-92952 Source advisory: OSV:GHSA-JF8Q-945G-9Q4C...

@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92940 via vm2 (>=3.11.3, <=3.11.6)

vm2 NPM version =3.11.3, =3.0.57, =0.1.0, =2.32.0, =1.0.0, =1.1.0, =0.2.0, =2.32.0, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.74.12 and more Source cves: CVE-2026-92940 Source advisory: OSV:GHSA-H85J-HV3C-QFGQ...

@dataform/cli (>=3.0.59-alpha.1, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92935 via vm2 (>=3.11.4, <=3.11.6)

vm2 NPM version =3.11.4, =3.0.59-alpha.1, =0.1.0, =2.32.0, =1.8.2, =1.1.0, =0.2.0, =2.32.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.74.12 and more Source cves: CVE-2026-92935 Source advisory: OSV:GHSA-8HR7-R645-PC6W...

@dataform/cli (>=3.0.66, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92937 via vm2 (3.11.6)

vm2 NPM version 3.11.6 is affected by a known vulnerability. The following packages have a transitive dependency on vm2 and may be impacted: - @dataform/cli =3.0.66, =0.1.0, =2.36.1, =1.32.0, =1.1.0, =0.2.0, =2.36.1, =2.0.4, =1.74.7, =1.74.8, =1.74.8, =1.74.8, =1.74.8, =1.74.8, =1.74.12 and more...

@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92938 via vm2 (>=3.11.3, <=3.11.6)

vm2 NPM version =3.11.3, =3.0.57, =0.1.0, =2.32.0, =1.0.0, =1.1.0, =0.2.0, =2.32.0, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.74.12 and more Source cves: CVE-2026-92938 Source advisory: OSV:GHSA-6W8R-XXW2-G3HX...

@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92939 via vm2 (>=3.11.3, <=3.11.6)

vm2 NPM version =3.11.3, =3.0.57, =0.1.0, =2.32.0, =1.0.0, =1.1.0, =0.2.0, =2.32.0, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.74.12 and more Source cves: CVE-2026-92939 Source advisory: OSV:GHSA-46PR-C5WC-XFFX...

@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92941 via vm2 (>=3.11.3, <=3.11.6)

vm2 NPM version =3.11.3, =3.0.57, =0.1.0, =2.32.0, =1.0.0, =1.1.0, =0.2.0, =2.32.0, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.74.12 and more Source cves: CVE-2026-92941 Source advisory: SNYK:JS-VM2-20043907...

@dataform/cli (>=3.0.66, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92937 via vm2 (3.11.6)

vm2 NPM version 3.11.6 is affected by a known vulnerability. The following packages have a transitive dependency on vm2 and may be impacted: - @dataform/cli =3.0.66, =0.1.0, =2.36.1, =1.32.0, =1.1.0, =0.2.0, =2.36.1, =2.0.4, =1.74.7, =1.74.8, =1.74.8, =1.74.8, =1.74.8, =1.74.8, =1.74.12 and more...

@dataform/cli (>=3.0.59-alpha.1, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92935 via vm2 (>=3.11.4, <=3.11.6)

vm2 NPM version =3.11.4, =3.0.59-alpha.1, =0.1.0, =2.32.0, =1.8.2, =1.1.0, =0.2.0, =2.32.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.74.12 and more Source cves: CVE-2026-92935 Source advisory: SNYK:JS-VM2-20043635...

@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +22 more potentially affected by CVE-2026-92936 via vm2 (>=3.11.1, <=3.11.6)

vm2 NPM version =3.11.1, =3.0.57, =0.1.0, =2.32.0, =0.0.16, =1.4.13, =1.0.0, =1.1.0, =0.2.0, =1.0.0, =3.1.3, =2.32.0, =1.72.3, =2.0.9 and more Source cves: CVE-2026-92936 Source advisory: SNYK:JS-VM2-20043641...

@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92938 via vm2 (>=3.11.3, <=3.11.6)

vm2 NPM version =3.11.3, =3.0.57, =0.1.0, =2.32.0, =1.0.0, =1.1.0, =0.2.0, =2.32.0, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.74.12 and more Source cves: CVE-2026-92938 Source advisory: SNYK:JS-VM2-20043637...

@dataform/cli (>=3.0.59-alpha.1, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92952 via vm2 (>=3.11.4, <=3.11.6)

vm2 NPM version =3.11.4, =3.0.59-alpha.1, =0.1.0, =2.32.0, =1.8.2, =1.1.0, =0.2.0, =2.32.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.74.12 and more Source cves: CVE-2026-92952 Source advisory: SNYK:JS-VM2-20043629...

@cairncms/api (>=1.0.0-beta.1, <=1.0.0-beta.4), @dataform/cli (>=3.0.46, <=3.0.71) +25 more potentially affected by CVE-2026-92956 via vm2 (>=3.10.1, <=3.11.6)

vm2 NPM version =3.10.1, =1.0.0-beta.1, =3.0.46, =0.1.0, =2.32.0, =0.0.16, =1.4.13, =1.0.0, =1.0.0-beta.1, =1.1.0, =0.2.0, =1.0.0, =3.1.3, =3.1.4 - knowhy 0.1.2 and more Source cves: CVE-2026-92956 Source advisory: SNYK:JS-VM2-20043663...

CVE-2026-14934

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tena...

CVE-2026-14934

CVE-2026-14934 affects Google Cloud BigQuery, Dataform and Colab Enterprise repository creation functionality. A Missing Authorization flaw in versions from October 2025 through May 10, 2026 allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. The ...

CVE-2026-14934

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tena...

CVE-2026-14934 Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tena...

EUVD-2026-43338

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tena...