multi-clasp2 (4.0.0) potentially affected by CVE-2026-4092 via @google/clasp (3.1.3)

@google/clasp NPM version 3.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on @google/clasp and may be impacted: - multi-clasp2 4.0.0 Source cves: CVE-2026-4092 Source advisory: SNYK:JS-GOOGLECLASP-15248426...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @netlify/agent-runner-cli (>=1.0.0-broken, <=1.58.3) +15 more potentially affected by CVE-2026-24053 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.69)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =1.0.0-broken, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =0.11.1, =0.11.0, =1.0.0, =1.2.1 and more Source cves: CVE-2026-24053 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-15202063...

@circleci/agents (2.13.2-canary.8150572), @tessl/cli (>=0.21.0, <=0.21.2) +9 more potentially affected by CVE-2026-24052 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.108)

@anthropic-ai/claude-code NPM version =1.0.8, =0.21.0, =0.2.0, =0.1.34, =1.8.0, =0.1.44, =0.0.22, =0.0.11, =0.0.27, =0.0.31 - locadex 0.0.2-alpha.1 Source cves: CVE-2026-24052 Source advisory: OSV:GHSA-VHW5-3G5M-8GGF...

@amedia/brick-mcp (>=0.0.0-vEXPORT-20260113150210, <=0.1.5), @andesite-lab/andesite-core (>=1.60.2, <=1.61.0) +263 more potentially affected by CVE-2026-25223 via fastify (>=5.0.0, <=5.7.1)

fastify NPM version =5.0.0, =0.0.0-vEXPORT-20260113150210, =1.60.2, =2.0.1, =1.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.35, =0.0.82, =0.0.1, =0.0.6, =0.1.68, =6.0.0-alpha.1, =0.2.305, =1.0.6, =1.0.22 and more Source cves: CVE-2026-25223 Source advisory: OSV:GHSA-JX2C-RXCM-JVMQ...

@backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220), @techdocs/cli (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220) potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (1.14.0)

@backstage/plugin-techdocs-node NPM version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-techdocs-node and may be impacted: - @backstage/plugin-techdocs-backend =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240,...

@cedarjs/api-server (>=1.0.0-canary.12863, <=3.0.0-canary.13332), @cedarjs/cli (>=1.0.0-canary.12863, <=3.0.0-canary.13332) +13 more potentially affected by CVE-2026-23864 via react-server-dom-webpack (>=19.2.0-canary-cee7939b-20250625, <=19.2.3)

react-server-dom-webpack NPM version =19.2.0-canary-cee7939b-20250625, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...

flowflops (>=0.0.1.post2211140919, <=0.0.1.post2211151211) potentially affected by CVE-2025-70999 via oneflow (0.9.0)

oneflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on oneflow and may be impacted: - flowflops =0.0.1.post2211140919, =0.0.1.post2211151211 Source cves: CVE-2025-70999 Source advisory: SNYK:PYTHON-ONEFLOW-15162589...

flowflops (>=0.0.1.post2211140919, <=0.0.1.post2211151211) potentially affected by CVE-2025-65886 via oneflow (0.9.0)

oneflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on oneflow and may be impacted: - flowflops =0.0.1.post2211140919, =0.0.1.post2211151211 Source cves: CVE-2025-65886 Source advisory: SNYK:PYTHON-ONEFLOW-15162593...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @adenta/cms (>=0.0.6, <=1.1.1-0) +330 more potentially affected by CVE-2026-24842 via tar (>=7.0.0, <=7.5.6)

tar NPM version =7.0.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =0.1.1, =0.1.1, =2.17.11, =1.9.5, =8.8.3, =8.11.4 - @altipla/directus-sdk-utils 0.7.2 - @applitools/core 4.20.0 - @applitools/core-base 1.17.0 - @applitools/ec-client 1.9.6 - @applitools/eyes 1.23.0 and more Source cves:...

@auriclabs/sst-types (>=0.0.1, <=0.1.0), @ccci/micro-server (>=1.0.57, <=1.0.132) +15 more potentially affected by CVE-2026-24910 via bun (>=1.0.2, <=1.3.2)

bun NPM version =1.0.2, =0.0.1, =1.0.57, =0.1.0, =8.0.4, =1.0.0, =0.0.0, =1.2.27, =1.2.21, =0.0.2, =0.0.33, =0.1.3, =0.0.19-beta.11, =0.10.31, =0.15.2 and more Source cves: CVE-2026-24910 Source advisory: SNYK:JS-BUN-15123966...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +338 more potentially affected by CVE-2026-24473 via hono (>=4.0.0, <=4.11.6)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =1.8.0 and more Source cves: CVE-2026-24473 Source advisory: SNYK:JS-HONO-15123868...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +338 more potentially affected by CVE-2026-24398 via hono (>=4.0.0, <=4.11.6)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =1.8.0 and more Source cves: CVE-2026-24398 Source advisory: OSV:GHSA-R354-F388-2FHH...

@n8n/ai-workflow-builder (1.5.0), @n8n/api-types (1.5.0) +10 more potentially affected by CVE-2026-1470 via n8n-workflow (2.5.0)

n8n-workflow NPM version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-workflow and may be impacted: - @n8n/ai-workflow-builder 1.5.0 - @n8n/api-types 1.5.0 - @n8n/backend-common 1.5.0 - @n8n/backend-test-utils 1.5.0 - @n8n/db 1.5.0 -...

dydx-trading-sdk (>=0.1.1, <=0.1.5), locast (>=0.1.0, <=0.1.9) +1 more potentially affected by unknown CVE via dydx-v4-client (1.1.6)

dydx-v4-client PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on dydx-v4-client and may be impacted: - dydx-trading-sdk =0.1.1, =0.1.0, =0.1.1, =1.0.7 Source cves: unknown CVE Source advisory: SNYK:PYTHON-DYDXV4CLIENT-15244902...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +10 more potentially affected by CVE-2026-24131 via pnpm (>=10.0.0, <=10.18.3)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-24131 Source advisory: OSV:GHSA-V253-RJ99-JWPQ...

@directus/release-notes-generator (>=2.0.2, <=3.0.0), @eclipse-scout/releng (>=26.2.0, <=26.2.1) +78 more potentially affected by CVE-2026-24131 via @pnpm/package-bins (>=1000.0.0, <=1000.0.16)

@pnpm/package-bins NPM version =1000.0.0, =2.0.2, =26.2.0, =0.1.0-beta.0, =1000.3.2, =1000.0.21, =1000.1.1, =1000.0.0, =1007.0.1, =1002.2.0, =1002.3.0 - @pnpm/deps.compliance.commands 1000.0.0 and more Source cves: CVE-2026-24131 Source advisory: SNYK:JS-PNPMPACKAGEBINS-15102727...

@directus/release-notes-generator (>=2.0.2, <=3.0.0), @eclipse-scout/releng (>=26.2.0, <=26.2.1) +78 more potentially affected by CVE-2026-23890 via @pnpm/package-bins (>=1000.0.0, <=1000.0.15)

@pnpm/package-bins NPM version =1000.0.0, =2.0.2, =26.2.0, =0.1.0-beta.0, =1000.3.2, =1000.0.21, =1000.1.1, =1000.0.0, =1007.0.1, =1002.2.0, =1002.2.23 - @pnpm/deps.compliance.commands 1000.0.0 and more Source cves: CVE-2026-23890 Source advisory: SNYK:JS-PNPMPACKAGEBINS-15103738...

@1upmonster/duel (>=0.1.0, <=0.1.8), @flash_trade/magic-trade-client (>=0.1.0, <=1.0.51) +8 more potentially affected by CVE-2026-22696 via @phala/dcap-qvl-web (>=0.2.7, <=0.3.3)

@phala/dcap-qvl-web NPM version =0.2.7, =0.1.0, =0.1.0, =0.3.6, =0.2.9, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-22696 Source advisory: OSV:GHSA-796P-J2GH-9M2Q...

@aaronuu/react-forms (>=0.0.1, <=0.2.2), @actra-development-oss/redux-persist-transform-filter-immutable (>=0.1.1, <=1.0.0) +777 more potentially affected by CVE-2025-13465 via lodash.unset (>=4.0.2, <=4.18.0)

lodash.unset NPM version =4.0.2, =0.0.1, =0.1.1, =0.1.0, =0.0.1, =1.1.0, =0.0.4, =1.8.28, =1.1.0, =0.1.2, =0.0.1, =0.1.0, =0.0.1, =2.1.1 and more Source cves: CVE-2025-13465 Source advisory: SNYK:JS-LODASHUNSET-15053837...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.7-next.1), @backstage/backend-test-utils (>=1.10.1-next.0, <=1.10.2-next.1) +14 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (0.14.0-next.1)

@backstage/backend-defaults NPM version 0.14.0-next.1 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/backend-defaults and may be impacted: - @backstage/backend-dynamic-feature-service =0.0.0-nightly-20251218024537, =1.10.1-next.0,...