@everreal/react-charts (>=1.0.0 <=1.0.1-ff20697), @everreal/web-analytics (>=0.0.3 <=0.0.12) +1 more potentially affected by unknown CVE via undefsafe-typed (=1.0.2)

undefsafe-typed NPM version =1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on undefsafe-typed and may be impacted: - @everreal/react-charts =1.0.0, =0.0.3, =1.1.17, =1.2.5 Source cves: unknown CVE Source advisory: SNYK:JS-UNDEFSAFETYPED-14103745...

@asyncapi/server-api (>=0.16.0 <=0.16.23) potentially affected by unknown CVE via @asyncapi/java-spring-template (=1.6.0)

@asyncapi/java-spring-template NPM version =1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on @asyncapi/java-spring-template and may be impacted: - @asyncapi/server-api =0.16.0, =0.16.23 Source cves: unknown CVE Source advisory:...

css-dedoupe (>=0.1.0 <=0.1.1) potentially affected by unknown CVE via obj-to-css (=1.0.1)

obj-to-css NPM version =1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on obj-to-css and may be impacted: - css-dedoupe =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: SNYK:JS-OBJTOCSS-14103674...

@voiceflow/runtime-client-js (>=1.6.1 <=1.17.4) potentially affected by unknown CVE via @voiceflow/runtime (>=1.27.2 <=1.28.0)

@voiceflow/runtime NPM version =1.27.2, =1.6.1, =1.17.4 Source cves: unknown CVE Source advisory: SNYK:JS-VOICEFLOWRUNTIME-14103430...

@abtnode/blocklet-services (>=1.16.6 <=1.17.13-beta-20260512-042419-7b556a38), @abtnode/cli (>=1.0.0 <=1.16.34-beta-20241113-102431-65542b84) +446 more potentially affected by unknown CVE via shell-exec (>=1.0.2 <=1.1.2)

shell-exec NPM version =1.0.2, =1.16.6, =1.0.0, =1.16.6, =1.0.0, =0.3.35, =1.5.0, =0.0.0-beta.0, =0.0.0, =2.49.0, =1.0.0, =2.0.0-0, =2.0.0-0, =1.0.16, =1.0.0, =1.2.1, =1.3.16 and more Source cves: unknown CVE Source advisory: SNYK:JS-SHELLEXEC-14103722...

@lessondesk/schoolbus (>=3.0.43 <=5.2.1) potentially affected by unknown CVE via @tiaanduplessis/react-progressbar (=1.0.0)

@tiaanduplessis/react-progressbar NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @tiaanduplessis/react-progressbar and may be impacted: - @lessondesk/schoolbus =3.0.43, =5.2.1 Source cves: unknown CVE Source advisory:...

@asyncapi/cli (>=2.16.8 <=4.1.1), @asyncapi/server-api (=0.16.23) +1 more potentially affected by unknown CVE via @asyncapi/converter (>=1.4.17 <=1.5.0)

@asyncapi/converter NPM version =1.4.17, =2.16.8, =0.21.4, =1.1.0 Source cves: unknown CVE Source advisory: SNYK:JS-ASYNCAPICONVERTER-14103251...

@cycle-mega-driver/database (>=0.2.1 <=0.3.2), @fluidnotions/rx-pouch (>=0.6.7 <=0.6.8) +3 more potentially affected by unknown CVE via set-nested-prop (=2.0.0)

set-nested-prop NPM version =2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on set-nested-prop and may be impacted: - @cycle-mega-driver/database =0.2.1, =0.6.7, =1.0.0, =0.3.0, =0.6.9 Source cves: unknown CVE Source advisory:...

0pflow (>=0.1.0-dev.0de2bc6 <=0.1.0-dev.f5622ac), @adhisang/minecraft-modding-mcp (=1.0.0) +20 more potentially affected by unknown CVE via mcp-use (>=1.0.0 <=1.4.1)

mcp-use NPM version =1.0.0, =0.1.0-dev.0de2bc6, =1.0.0, =0.2.0, =2.0.3, =0.2.2, =0.0.1, =0.9.2, =0.3.0, =1.0.1, =1.14.0 - ask262 =0.0.15 - chrome-devtools-cli =1.0.0 - mcp-marketers =3.0.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-MCPUSE-14103656...

postman-cli (>=1.16.0-canary.1 <=1.24.2) potentially affected by unknown CVE via @postman/pm-bin-linux-x64 (>=1.16.0-canary.1 <=1.24.2)

@postman/pm-bin-linux-x64 NPM version =1.16.0-canary.1, =1.16.0-canary.1, =1.24.2 Source cves: unknown CVE Source advisory: SNYK:JS-POSTMANPMBINLINUXX64-14103292...

financelabsutilities (>=0.0.8 <=0.0.10) potentially affected by unknown CVE via react-hook-form-persist (=3.0.0)

react-hook-form-persist NPM version =3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-hook-form-persist and may be impacted: - financelabsutilities =0.0.8, =0.0.10 Source cves: unknown CVE Source advisory: SNYK:JS-REACTHOOKFORMPERSIST-141036...

axios-basic-logger (=1.0.0), react-micromodal.js (=1.0.0) potentially affected by unknown CVE via pico-uid (=1.0.2)

pico-uid NPM version =1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pico-uid and may be impacted: - axios-basic-logger =1.0.0 - react-micromodal.js =1.0.0 Source cves: unknown CVE Source advisory: SNYK:JS-PICOUID-14103684...

@asyncapi-actions-test/trusted-publishing-test_asyncapi-cli (>=4.1.3 <=5.4.0), @asyncapi/cli (>=3.3.0 <=6.0.2) +3 more potentially affected by unknown CVE via @asyncapi/problem (=1.0.0)

@asyncapi/problem NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @asyncapi/problem and may be impacted: - @asyncapi-actions-test/trusted-publishing-testasyncapi-cli =4.1.3, =3.3.0, =0.16.0, =1.4.14, =1.4.50 -...

@asyncapi/cli (>=1.4.0 <=2.16.7) potentially affected by unknown CVE via @asyncapi/studio (=0.20.2)

@asyncapi/studio NPM version =0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on @asyncapi/studio and may be impacted: - @asyncapi/cli =1.4.0, =2.16.7 Source cves: unknown CVE Source advisory: OSV:MAL-2025-190863...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0 <=4.0.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0 <=4.0.2) +18 more potentially affected by CVE-2025-65998 via org.apache.syncope.core:syncope-core-provisioning-java (>=4.0.0-M0 <=4.0.2)

org.apache.syncope.core:syncope-core-provisioning-java MAVEN version =4.0.0-M0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.2 and more Source cves: CVE-2...

accessiqlue (=2025.12.21154255), agent-builder (>=0.0.2 <=0.1.7) +320 more potentially affected by CVE-2025-65106 via langchain-core (>=0.4.0.dev0 <=1.0.5)

langchain-core PYPI version =0.4.0.dev0, =0.0.2, =0.1.0, =0.1.1 - ai-benchmark-analyzer =2025.12.21193050 - ai-claim-essence =2025.12.20202921 - ai-design-insights =2025.12.21145447 - ai-mysql-translator =2025.12.21101721 - ai-reliability-analyzer =2025.12.21171415 - ai-risk-extractor...

@bpa-solutions/assistant (>=13.5.0 <=13.5.0-dev), @mazaal-dev/piece-markdown-to-pdf (=0.0.2) +1 more potentially affected by CVE-2025-65108 via md-to-pdf (>=5.0.1 <=5.2.4)

md-to-pdf NPM version =5.0.1, =13.5.0, =0.11.1, =0.11.2 Source cves: CVE-2025-65108 Source advisory: SNYK:JS-MDTOPDF-14089788...

@avalabs/avalanche-module (>=0.0.0-CP-8940-20240801175729 <=3.9.1), @avalabs/bitcoin-module (>=0.0.0-CP-8940-20240801175729 <=3.9.1) +19 more potentially affected by CVE-2025-64767 via @hpke/core (>=1.2.5 <=1.7.4)

@hpke/core NPM version =1.2.5, =0.0.0-CP-8940-20240801175729, =0.0.0-CP-8940-20240801175729, =2.8.0-canary.a436aaa.0, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-canary.a436aaa.0, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-canary.a436aaa.0,...

@dadigua/hyper-chat (>=1.2.3 <=1.2.16), @rse/closingcredits (>=1.0.1 <=1.0.5) +3 more potentially affected by CVE-2025-13437 via zx (>=8.0.0 <=8.1.0)

zx NPM version =8.0.0, =1.2.3, =1.0.1, =2.15.6, =2.15.6, =3.0.5, =3.0.10 Source cves: CVE-2025-13437 Source advisory: SNYK:JS-ZX-14089787...

1shot (>=0.0.3 <=0.0.9), @4xian/ccapi (=1.0.6) +210 more potentially affected by CVE-2025-65099 via @anthropic-ai/claude-code (>=1.0.108 <=1.0.24)

@anthropic-ai/claude-code NPM version =1.0.108, =0.0.3, =0.1.18, =1.0.0, =0.4.0, =0.2.3, =0.0.1, =0.6.0-rc34, =1.0.0, =1.3.2-canary.5af7e49 - @chittycorp/chittychat =3.0.0 and more Source cves: CVE-2025-65099 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-14073012...