@cedarjs/api-server (>=1.0.0-canary.12863 <=3.0.0-canary.13332), @cedarjs/cli (>=1.0.0-canary.12863 <=3.0.0-canary.13332) +10 more potentially affected by CVE-2025-55184 +1 more via react-server-dom-webpack (>=19.2.1 <=19.2.3)

react-server-dom-webpack NPM version =19.2.1, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...

nearai-cloud-verifier (=0.0.1-alpha.1) potentially affected by CVE-2026-22696 via @phala/dcap-qvl-node (=0.3.3)

@phala/dcap-qvl-node NPM version =0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on @phala/dcap-qvl-node and may be impacted: - nearai-cloud-verifier =0.0.1-alpha.1 Source cves: CVE-2026-22696 Source advisory: OSV:GHSA-796P-J2GH-9M2Q...

@0x57/pierre (>=0.0.3 <=0.0.16), @0xshogun/sdk (>=1.1.44 <=1.1.52) +380 more potentially affected by CVE-2025-50537 via eslint (>=9.0.0-rc.0 <=9.25.1)

eslint NPM version =9.0.0-rc.0, =0.0.3, =1.1.44, =1.1.14, =0.0.1-alpha.3, =2.6.0, =2.2.9, =0.0.2, =0.0.0-dev-20250424035410, =1.0.68, =0.0.4, =0.0.66, =0.0.3, =1.0.0, =1.0.0, =1.0.2 and more Source cves: CVE-2025-50537 Source advisory: SNYK:JS-ESLINT-15102420...

openwebui-token-tracking (=0.1.7) potentially affected by CVE-2026-0766 via open-webui (=0.6.0)

open-webui PYPI version =0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking =0.1.7 Source cves: CVE-2026-0766 Source advisory: SNYK:PYTHON-OPENWEBUI-15091593...

langflow-nightly (=1.8.0.dev24) potentially affected by CVE-2026-0772 via langflow-base (=0.7.2)

langflow-base PYPI version =0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly =1.8.0.dev24 Source cves: CVE-2026-0772 Source advisory: SNYK:PYTHON-LANGFLOWBASE-15091577...

ai-safety-engine (=0.1.0) potentially affected by CVE-2026-0773 via upsonic (=0.60.0a1754435135)

upsonic PYPI version =0.60.0a1754435135 is affected by a known vulnerability. The following packages have a transitive dependency on upsonic and may be impacted: - ai-safety-engine =0.1.0 Source cves: CVE-2026-0773 Source advisory: SNYK:PYTHON-UPSONIC-15091585...

dzbanek-langflow-base (>=0.6.0 <=0.6.1), langflow-base (>=0.7.0 <=0.8.0rc2) +1 more potentially affected by CVE-2026-0770 via lfx (>=0.1.13 <=0.3.4)

lfx PYPI version =0.1.13, =0.6.0, =0.7.0, =0.8.0rc2 - langflow-nightly =1.8.0.dev24 Source cves: CVE-2026-0770 Source advisory: SNYK:PYTHON-LFX-15091579...

orval (>=8.0.0 <=8.0.2) potentially affected by CVE-2026-24132 via @orval/mock (>=8.0.0-rc.0 <=8.0.2)

@orval/mock NPM version =8.0.0-rc.0, =8.0.0, =8.0.2 Source cves: CVE-2026-24132 Source advisory: SNYK:JS-ORVALMOCK-15091570...

com.almis.awe:awe-annotation (>=4.10.11 <=4.11.2), com.almis.awe:awe-annotations-spring-boot-starter (>=4.10.11 <=4.11.2) +107 more potentially affected by CVE-2025-22234 via org.springframework.security:spring-security-core (=6.3.8)

org.springframework.security:spring-security-core MAVEN version =6.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.almis.awe:awe-annotation =4.10.11, =4.10.11, =4.10.11,...

be.personify.iam:personify-frontend (>=1.5.4.RELEASE <=1.5.7.RELEASE), ch.admin.bit.jeap:jeap-archrepo-instance (>=1.12.0 <=1.14.0) +1376 more potentially affected by CVE-2025-22234 via org.springframework.security:spring-security-core (=6.4.4)

org.springframework.security:spring-security-core MAVEN version =6.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - be.personify.iam:personify-frontend =1.5.4.RELEASE, =1.12.0,...

actix-session-surrealdb (>=0.1.0 <=0.1.5) potentially affected by unknown CVE via surrealdb (=1.0.0-beta.9)

surrealdb CARGO version =1.0.0-beta.9 is affected by a known vulnerability. The following packages have a transitive dependency on surrealdb and may be impacted: - actix-session-surrealdb =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: OSV:GHSA-3V2X-9XCV-2V2V...

io4it (=3.0.4.1) potentially affected by CVE-2026-24009 via docling-core (=2.26.3)

docling-core PYPI version =2.26.3 is affected by a known vulnerability. The following packages have a transitive dependency on docling-core and may be impacted: - io4it =3.0.4.1 Source cves: CVE-2026-24009 Source advisory: OSV:GHSA-VQXF-V2GG-X3HC...

io4it (=3.0.4.1) potentially affected by CVE-2020-14343 +1 more via docling-core (=2.26.3)

docling-core PYPI version =2.26.3 is affected by a known vulnerability. The following packages have a transitive dependency on docling-core and may be impacted: - io4it =3.0.4.1 Source cves: CVE-2020-14343, CVE-2026-24009 Source advisory: SNYK:PYTHON-DOCLINGCORE-15091522...

org.webjars.npm:solid-js (=1.9.5) potentially affected by CVE-2026-24006 via org.webjars.npm:seroval (=1.2.1)

org.webjars.npm:seroval MAVEN version =1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js =1.9.5 Source cves: CVE-2026-24006 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054528...

-fides-amor-et-lux (=1.0.0), 0.electron.main (>=1.0.49 <=1.0.50) +34378 more potentially affected by CVE-2025-13465 via lodash (>=4.0.0 <=4.17.21)

lodash NPM version =4.0.0, =1.0.49, =1.0.7, =1.0.0, =1.0.0, =0.0.2, =0.1.1, =1.0.0, =1.0.0, =3.7.1, =4.0.12 - 3---nodejs-npm =1.0.0 and more Source cves: CVE-2025-13465 Source advisory: OSV:GHSA-XXJR-MMJV-4GPG...

-fides-amor-et-lux (=1.0.0), 0.electron.main (>=1.0.49 <=1.0.50) +34378 more potentially affected by CVE-2025-13465 via lodash (>=4.0.0 <=4.17.21)

lodash NPM version =4.0.0, =1.0.49, =1.0.7, =1.0.0, =1.0.0, =0.0.2, =0.1.1, =1.0.0, =1.0.0, =3.7.1, =4.0.12 - 3---nodejs-npm =1.0.0 and more Source cves: CVE-2025-13465 Source advisory: SNYK:JS-LODASH-15053838...

com.newmediaworks:nmw-oss-website (>=1.7.0 <=1.11.0), com.pragmatickm:website (>=1.10.0 <=2.0.0) +29 more potentially affected by CVE-2025-13465 via org.webjars.npm:lodash (>=4.0.0 <=4.17.21)

org.webjars.npm:lodash MAVEN version =4.0.0, =1.7.0, =1.10.0, =1.11.0, =1.7.0, =1.6.1, =1.11.0, =1.13.0, =1.0, =1.0, =1.0, =1.0.0-M1, =1.0.0-beta7 - org.webjars.npm:github-com-bevacqua-horsey =4.2.2 - org.webjars.npm:graphql-toolkitcommon =0.7.5 and more Source cves: CVE-2025-13465 Source advisor...

@dojo/cli-test-intern (>=0.1.0 <=2.0.0-beta3.1), express_mvc (>=4.1.1 <=4.3.10) +7 more potentially affected by CVE-2025-13465 via lodash-amd (=4.16.4)

lodash-amd NPM version =4.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on lodash-amd and may be impacted: - @dojo/cli-test-intern =0.1.0, =4.1.1, =3.4.0, =0.0.1, =1.0.14, =0.0.7, =0.0.1, =0.1.5 - xirtam--matrix-operations =0.1.3 Source cves:...

@astrojs/cloudflare (=0.4.0), @cfpreview/pages-e2e-test-runner-cli (>=0.0.1 <=0.0.8) +20 more potentially affected by CVE-2026-0933 via wrangler (>=2.0.23 <=3.114.1)

wrangler NPM version =2.0.23, =0.0.1, =1.0.387, =0.5.41, =2.1.0, =0.0.0-next-20230221055802, =1.0.0, =0.0.3, =0.0.47, =1.0.0, =1.0.0, =0.1.1, =0.1.106 and more Source cves: CVE-2026-0933 Source advisory: OSV:GHSA-36P8-MVP6-CV38...

@alithya-oss/backstage-plugin-aws-apps-backend (=0.4.7), @alithya-oss/backstage-plugin-changelog-backend (=1.0.3) +165 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448 <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =1.0.7, =0.1.8, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =4.6.0, =0.10.0, =0.12.0 and more Source cves: CVE-2026-24048 Source advisory: SNYK:JS-BACKSTAGEBACKENDDEFAULTS-15064476...