better-config-loader (>=0.1.4, <=0.2.4), blazen (>=0.1.93, <=0.1.151) +103 more potentially affected by unknown CVE via libyml (>=0.0.1, <=0.0.5)

libyml CARGO version =0.0.1, =0.1.4, =0.1.93, =0.1.131, =0.2.0, =0.33.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.14.0, =0.14.0, =0.3.0, =0.4.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0067...

alerter (>=0.3.0, <=0.3.2), crate_glitch (0.2.0) +14 more potentially affected by CVE-2025-59047 via matrix-sdk-base (>=0.1.0, <=0.5.1)

matrix-sdk-base CARGO version =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.10-alpha, =0.13.0, =0.13.1 and more Source cves: CVE-2025-59047 Source advisory: OSV:RUSTSEC-2025-0000...

@angularexpert/my-workspace (0.0.0), @cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4) +47 more potentially affected by CVE-2025-59052 via @angular/platform-server (>=16.2.12, <=18.2.13)

@angular/platform-server NPM version =16.2.12, =1.0.0, =0.0.1, =1.4.1, =1.1.1, =0.1.0, =13.1.0, =0.0.0, =2.1.0, =0.0.2, =0.0.11 and more Source cves: CVE-2025-59052 Source advisory: OSV:GHSA-68X2-MX4Q-78M7...

drivesync (0.1.0), geckopanda (>=0.1.0, <=0.2.0) +601 more potentially affected by unknown CVE via google-apis-common (>=4.0.1, <=6.0.4)

google-apis-common CARGO version =4.0.1, =0.1.0, =5.0.2-beta-1+20230114, =5.0.2-beta-1+20230123, =5.0.2-beta-1+20230120, =5.0.2-beta-1+20200708, =5.0.2-beta-1+20230123, =5.0.2-beta-1+20230123, =5.0.2-beta-1+20210330, =5.0.4+20210330 and more Source cves: unknown CVE Source advisory:...

accesskit_windows (>=0.5.0, <=0.10.4), accesskit_winit (>=0.2.0, <=0.7.2) +426 more potentially affected by unknown CVE via servo-fontconfig (>=0.4.0, <=0.5.1)

servo-fontconfig CARGO version =0.4.0, =0.5.0, =0.2.0, =0.5.0, =0.11.0, =0.2.0, =0.1.0, =0.8.0, =0.6.0, =0.4.0, =0.8.0, =0.2.0, =0.6.0, =0.15.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0059...

aa2nucaln (0.1.1), agent-stream-kit (>=0.9.0, <=0.14.0) +435 more potentially affected by unknown CVE via custom_derive (0.1.7)

customderive CARGO version 0.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on customderive and may be impacted: - aa2nucaln 0.1.1 - agent-stream-kit =0.9.0, =0.4.0, =0.1.1, =0.2.0, =0.4.3, =0.1.0, =0.1.0, =0.1.0-alpha.1, =0.1.0, =3.1.3, =0.3.7, =0.8...

a2d (>=0.1.0, <=0.1.11), abscissa (>=0.6.0-beta.1, <=0.6.0-rc.0) +1452 more potentially affected by unknown CVE via adler (>=0.2.3, <=1.0.2)

adler CARGO version =0.2.3, =0.1.0, =0.6.0-beta.1, =0.6.0-beta.1, =0.6.0-beta.1, =0.1.5, =0.21.0-alpha.1, =0.0.1-dev.10, =0.4.0, =4.0.1-alpha.1, =0.2.0, =0.1.0, =0.0.2, =0.5.4-rc.1, =1.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0056...

@jill64/svelte-dark-theme (>=2.3.65, <=5.1.7), @jill64/svelte-i18n (>=1.1.27, <=2.2.1) +9 more potentially affected by CVE-2025-57820 via devalue (>=5.0.0, <=5.1.1)

devalue NPM version =5.0.0, =2.3.65, =1.1.27, =1.1.21, =1.2.263, =2.2.3, =0.0.2-dev.84, =1.0.23, =1.0.22, =1.0.0, =1.0.6, =2.1.10, =2.1.15 Source cves: CVE-2025-57820 Source advisory: OSV:GHSA-VJ54-72F3-P5JV...

OSV-2025-684 Heap-buffer-overflow in TGAHandler::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=440585455 Crash type: Heap-buffer-overflow WRITE 4 Crash state: TGAHandler::read kimgiofuzzer.cc...

@hpcc-js/esbuild-plugins (>=1.4.2, <=1.4.9), @yangzw/bruce-app (>=1.3.7, <=1.3.8) +1 more potentially affected by CVE-2025-57753 via vite-plugin-static-copy (>=3.0.0, <=3.1.1)

vite-plugin-static-copy NPM version =3.0.0, =1.4.2, =1.3.7, =1.3.8 - auto-reveal 0.7.0 Source cves: CVE-2025-57753 Source advisory: OSV:GHSA-PP7P-Q8FX-2968...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @deconz-community/directus-extension-ddf-store (0.1.0) +5 more potentially affected by CVE-2025-55746 via @directus/api (>=14.1.0, <=28.0.1)

@directus/api NPM version =14.1.0, =1.6.3, =1.2.2, =10.8.0, =1.0.0, =2.0.0 - directus-extension-blog-year-filter 1.0.0 Source cves: CVE-2025-55746 Source advisory: OSV:GHSA-MV33-9F6J-PFMC...

OSV-2025-638 Security exception in com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializer$Vanilla.deser

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=438873397 Crash type: Security exception Crash state: com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializer$Vanilla.deser com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializer$Vanilla.mapOb...

1yoouoo (>=0.0.5, <=0.1.2), bluebottle-magento-marketplace (>=1.1.2, <=1.2.5) +6 more potentially affected by unknown CVE via module-name (0.0.1-security)

module-name NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on module-name and may be impacted: - 1yoouoo =0.0.5, =1.1.2, =0.0.2, =1.0.1, =1.0.0, =1.0.1 Source cves: unknown CVE Source advisory: OSV:MAL-2025-26605...

bakpiabathok-3 (1.1.6), bonteng-1 (1.1.6) +1 more potentially affected by unknown CVE via bonteng (0.0.1-security)

bonteng NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on bonteng and may be impacted: - bakpiabathok-3 1.1.6 - bonteng-1 1.1.6 - kolekcau-2 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-15953...

big-integer-max (1.0.0), big-integer-min (>=1.0.0, <=1.0.1) +25 more potentially affected by unknown CVE via just-next-tick (0.0.0)

just-next-tick NPM version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on just-next-tick and may be impacted: - big-integer-max 1.0.0 - big-integer-min =1.0.0, =0.0.3, =0.0.0, =0.0.0, =0.0.0, =0.0.1, =0.0.9 and more Source cves: unknown CVE Sour...

risczero-01 (1.0.0), tea02-ddomutrr (1.0.1) +14 more potentially affected by unknown CVE via api-chatfb (0.0.1-security)

api-chatfb NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on api-chatfb and may be impacted: - risczero-01 1.0.0 - tea02-ddomutrr 1.0.1 - tea03-zhangmaxq 1.0.1 - tea05-armyben66 1.0.2 - tea06-meogak88 1.0.1 - tea07-xokohero...

h1-cli-device-browser (>=1.0.1-alpha.0, <=1.0.1-alpha.1), h1-cli-device-node (>=1.0.1-alpha.0, <=1.0.1-alpha.1) potentially affected by unknown CVE via h1-cli-ext-iam-project-select (1.0.1-alpha.1)

h1-cli-ext-iam-project-select NPM version 1.0.1-alpha.1 is affected by a known vulnerability. The following packages have a transitive dependency on h1-cli-ext-iam-project-select and may be impacted: - h1-cli-device-browser =1.0.1-alpha.0, =1.0.1-alpha.0, =1.0.1-alpha.1 Source cves: unknown CVE...

assume (>=0.0.10, <=1.4.0), atomify (>=7.1.0, <=7.3.1) +32 more potentially affected by unknown CVE via style-format (>=0.0.0, <=2.0.0)

style-format NPM version =0.0.0, =0.0.10, =7.1.0, =0.0.8, =0.0.0, =0.0.0, =0.0.0, =1.0.0, =0.0.0, =0.0.2 - fd-select 1.0.0 - frp-tick 1.0.0 - generator-freekerneljs 0.6.0 - hearing-aid 1.0.0 and more Source cves: unknown CVE Source advisory: OSV:MAL-2025-34115...

alert (>=0.0.0, <=0.0.1), audio-play (1.0.0) +13 more potentially affected by unknown CVE via new-chain (>=0.0.0, <=2.0.0)

new-chain NPM version =0.0.0, =0.0.0, =0.0.0, =1.0.1, =0.0.0, =0.0.9, =0.0.0, =3.0.0, =0.0.0, =0.0.0, =0.0.0, =0.0.0, =0.0.1 Source cves: unknown CVE Source advisory: OSV:MAL-2025-27356...

level-json-cache (0.0.0), midibin-api (0.0.0) +6 more potentially affected by unknown CVE via level-json (>=0.0.2, <=2.0.0)

level-json NPM version =0.0.2, =0.0.0, =0.0.0, =0.0.0, =0.0.0, =0.0.0, =0.2.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-25199...