org.webjars.npm:browser-sync-ui (2.27.11), org.webjars.npm:bulma (1.0.0) +21 more potentially affected by CVE-2026-29063 via org.webjars.npm:immutable (>=3.7.6, <=5.1.3)

org.webjars.npm:immutable MAVEN version =3.7.6, =0.7.0, =0.8.3, =0.8.4 - org.webjars.npm:flux 2.1.1 - org.webjars.npm:github-com-codeforms-punica-css-framework 3.0.0 - org.webjars.npm:github-com-datatables-datatablessrc 2.0.5 - org.webjars.npm:github-com-digicorp-propeller 1.3.2 -...

-graphql-codegen-client-preset-swc-test (>=2.0.1, <=2.0.2), 01-test-button (>=1.0.0, <=1.0.2) +11038 more potentially affected by CVE-2026-29063 via immutable (>=3.0.1, <=3.8.2)

immutable NPM version =3.0.1, =2.0.1, =1.0.0, =0.0.2, =0.2.0, =2.0.0-rc3, =1.0.0, =1.0.0, =0.1.0, =4.2.1, =6.2.1, =13.6.1, =13.7.2 and more Source cves: CVE-2026-29063 Source advisory: OSV:GHSA-WF6X-7X77-MVGW...

@alessiodf/core-chameleon (0.0.1), @arkecosystem/core (>=3.0.0-alpha.0, <=3.12.0) +131 more potentially affected by CVE-2026-29063 via immutable (>=5.0.0, <=5.1.4)

immutable NPM version =5.0.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.6, =3.9.0-rc.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =0.1.0, =1.0.6 - @dreamcatcher-tech/web 0.0.0 and more Source cves: CVE-2026-29063 Source advisory: OSV:GHSA-WF6X-7X77-MVGW...

@0xgraph/cli (>=0.0.1, <=0.2.1), @actra-development-oss/redux-persistable (>=2.0.0, <=3.0.0) +651 more potentially affected by CVE-2026-29063 via immutable (>=4.0.0, <=4.3.7)

immutable NPM version =4.0.0, =0.0.1, =2.0.0, =0.2.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.0.1, =0.11.8-rc.0, =0.1.0, =0.3.3 - @alfresco/adf-testing 6.0.0-A.2-8258 - @alys-chain/graph-alys-cli 0.88.0 and more Source cves: CVE-2026-29063 Source advisory: SNYK:JS-IMMUTABLE-15423650...

@alessiodf/core-chameleon (0.0.1), @arkecosystem/core (>=3.0.0-alpha.0, <=3.12.0) +131 more potentially affected by CVE-2026-29063 via immutable (>=5.0.0, <=5.1.4)

immutable NPM version =5.0.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.6, =3.9.0-rc.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =0.1.0, =1.0.6 - @dreamcatcher-tech/web 0.0.0 and more Source cves: CVE-2026-29063 Source advisory: SNYK:JS-IMMUTABLE-15423650...

better-auth-cloudflare (0.1.0), next-ai-draw-io (0.4.10) potentially affected by CVE-2026-3125 via @opennextjs/cloudflare (>=1.0.1, <=1.14.8)

@opennextjs/cloudflare NPM version =1.0.1, =1.14.8 is affected by a known vulnerability. The following packages have a transitive dependency on @opennextjs/cloudflare and may be impacted: - better-auth-cloudflare 0.1.0 - next-ai-draw-io 0.4.10 Source cves: CVE-2026-3125 Source advisory:...

lemmy_server (>=0.11.3-rc.5, <=0.16.7) potentially affected by CVE-2026-29178 via lemmy_routes (>=0.11.3-rc.5, <=0.16.7)

lemmyroutes CARGO version =0.11.3-rc.5, =0.11.3-rc.5, =0.16.7 Source cves: CVE-2026-29178 Source advisory: OSV:GHSA-JVXV-2JJP-JXC3...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @agimon-ai/browse-tool (>=0.2.0, <=0.5.5) +207 more potentially affected by CVE-2026-29087 via @hono/node-server (>=1.0.2, <=1.19.9)

@hono/node-server NPM version =1.0.2, =0.1.8-fix.3, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =1.0.25-beta.0, =0.0.1, =0.0.1-experimental.1, =0.1.0, =0.3.4 - @babybase/ui 0.2.0 and more Source cves: CVE-2026-29087 Source advisory: OSV:GHSA-WC8C-QW6V-H7F6...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @agimon-ai/browse-tool (>=0.2.0, <=0.5.5) +207 more potentially affected by CVE-2026-29087 via @hono/node-server (>=1.0.2, <=1.19.9)

@hono/node-server NPM version =1.0.2, =0.1.8-fix.3, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =1.0.25-beta.0, =0.0.1, =0.0.1-experimental.1, =0.1.0, =0.3.4 - @babybase/ui 0.2.0 and more Source cves: CVE-2026-29087 Source advisory: SNYK:JS-HONONODESERVER-15425963...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +381 more potentially affected by CVE-2026-29086 via hono (>=4.0.0, <=4.12.3)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =0.0.19 and more Source cves: CVE-2026-29086 Source advisory: OSV:GHSA-5PQ2-9X2X-5P6W...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +381 more potentially affected by CVE-2026-29085 via hono (>=4.0.0, <=4.12.3)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =0.0.19 and more Source cves: CVE-2026-29085 Source advisory: OSV:GHSA-P6XX-57QC-3WXR...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +381 more potentially affected by CVE-2026-29045 +1 more via hono (>=4.0.0, <=4.12.3)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =0.0.19 and more Source cves: CVE-2026-29045, CVE-2026-6414 Source advisory: OSV:GHSA-Q5QW-H33P-QVWR...

@7365admin1/layer-common (>=3.0.8, <=3.2.6), @_sh/strapi-plugin-ckeditor (>=7.0.0, <=7.1.0) +95 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-html-support (>=47.0.0, <=47.5.0-alpha.8)

@ckeditor/ckeditor5-html-support NPM version =47.0.0, =3.0.8, =7.0.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.5....

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +1486 more potentially affected by CVE-2026-28343 via ckeditor5 (>=29.2.0, <=47.5.0-alpha.8)

ckeditor5 NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =29.2.0, =2.0.0, =30.0.0, =0.7.0, =1.0.0, =0.0.3, =0.0.6, =1.3.0, =1.5.3 and more Source cves: CVE-2026-28343 Source advisory: OSV:GHSA-JRQM-VMQC-GM93...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +668 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-html-support (>=29.2.0, <=47.5.0-alpha.8)

@ckeditor/ckeditor5-html-support NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =42.0.1, =2.0.0, =0.7.0, =0.0.6, =1.0.1, =0.0.1, =0.0.1, =1.0.0, =36.0.0, =0.0.2, =0.0.31 and more Source cves: CVE-2026-28343 Source advisory: OSV:GHSA-JRQM-VMQC-GM93...

@7365admin1/layer-common (>=3.0.8, <=3.2.6), @_sh/strapi-plugin-ckeditor (>=7.0.0, <=7.1.0) +95 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-engine (>=47.0.0, <=47.5.0-alpha.8)

@ckeditor/ckeditor5-engine NPM version =47.0.0, =3.0.8, =7.0.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.0.0-alpha.0, =47.5.0 and...

4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1510 more potentially affected by CVE-2026-3520 via multer (>=2.0.0, <=2.1.0)

multer NPM version =2.0.0, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =0.6.2 and more Source cves: CVE-2026-3520 Source advisory: SNYK:JS-MULTER-15417528...

org.webjars.npm:nestjs__platform-express (>=8.4.7, <=9.0.0-next.2) potentially affected by CVE-2026-3520 via org.webjars.npm:multer (1.4.4-lts.1)

org.webjars.npm:multer MAVEN version 1.4.4-lts.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:multer and may be impacted: - org.webjars.npm:nestjsplatform-express =8.4.7, =9.0.0-next.2 Source cves: CVE-2026-3520 Source advisory:...

@zextras/carbonio-admin-ui (>=0.4.4-devel.1654173975013, <=0.9.30), @zextras/carbonio-design-system (>=0.1.3-devel.0, <=12.0.3) +9 more potentially affected by CVE-2025-68467 via darkreader (>=4.7.15, <=4.9.105)

darkreader NPM version =4.7.15, =0.4.4-devel.1654173975013, =0.1.3-devel.0, =0.3.0-devel.1642600405487, =0.1.0-beta.12, =0.1.0-beta.6, =0.1.0-beta.0, =1.1.11, =0.1.1-beta.0, =2.1.0, =2.2.0 - samagra-ui 1.0.1 Source cves: CVE-2025-68467 Source advisory: SNYK:JS-DARKREADER-15441035...

@zextras/carbonio-admin-ui (>=0.4.4-devel.1654173975013, <=0.9.30), @zextras/carbonio-design-system (>=0.1.3-devel.0, <=12.0.3) +9 more potentially affected by CVE-2025-68467 via darkreader (>=4.7.15, <=4.9.105)

darkreader NPM version =4.7.15, =0.4.4-devel.1654173975013, =0.1.3-devel.0, =0.3.0-devel.1642600405487, =0.1.0-beta.12, =0.1.0-beta.6, =0.1.0-beta.0, =1.1.11, =0.1.1-beta.0, =2.1.0, =2.2.0 - samagra-ui 1.0.1 Source cves: CVE-2025-68467 Source advisory: OSV:GHSA-X369-MCW8-8RVJ...