@activepieces/piece-ai (>=0.3.1, <=0.3.4), @agent-vm/agent-vm (>=0.0.138, <=0.0.148) +695 more potentially affected by CVE-2026-54288 via hono (>=4.0.0, <=4.12.24)

hono NPM version =4.0.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-54288 Source advisory: SNYK:JS-HONO-17356388...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @agent-vm/agent-vm (>=0.0.138, <=0.0.148) +695 more potentially affected by CVE-2026-54289 via hono (>=4.0.0, <=4.12.24)

hono NPM version =4.0.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-54289 Source advisory: SNYK:JS-HONO-17356391...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @agent-vm/agent-vm (>=0.0.138, <=0.0.148) +695 more potentially affected by CVE-2026-54289 via hono (>=4.0.0, <=4.12.24)

hono NPM version =4.0.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-54289 Source advisory: OSV:GHSA-WGPF-JWQJ-8H8P...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @agent-vm/agent-vm (>=0.0.138, <=0.0.148) +695 more potentially affected by CVE-2026-54290 via hono (>=4.0.0, <=4.12.24)

hono NPM version =4.0.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-54290 Source advisory: OSV:GHSA-88FW-HQM2-52QC...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @agent-vm/agent-vm (>=0.0.138, <=0.0.148) +695 more potentially affected by CVE-2026-54286 via hono (>=4.0.0, <=4.12.24)

hono NPM version =4.0.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-54286 Source advisory: GHSA-WWFH-H76J-FC44...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @agent-vm/agent-vm (>=0.0.138, <=0.0.148) +695 more potentially affected by CVE-2026-54286 via hono (>=4.0.0, <=4.12.24)

hono NPM version =4.0.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-54286 Source advisory: OSV:GHSA-WWFH-H76J-FC44...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @agent-vm/agent-vm (>=0.0.138, <=0.0.148) +695 more potentially affected by CVE-2026-54287 via hono (>=4.0.0, <=4.12.24)

hono NPM version =4.0.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-54287 Source advisory: SNYK:JS-HONO-17356429...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @agent-vm/agent-vm (>=0.0.138, <=0.0.148) +695 more potentially affected by CVE-2026-54287 via hono (>=4.0.0, <=4.12.24)

hono NPM version =4.0.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-54287 Source advisory: OSV:GHSA-J6C9-X7QJ-28XF...

askflow-cli (1.0.0), can-box-chw (0.0.3) +33 more potentially affected by unknown CVE via bleach (3.2.1)

bleach PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - askflow-cli 1.0.0 - can-box-chw 0.0.3 - commondtools =0.0.19, =0.0.32, =0.0.38, =0.1.0, =0.0.1, =0.18.0, =0.3.0, =0.0.1, =1.0.1, =1.0.2 -...

alo7-airflow (>=1.10.0, <=1.10.0.7), cateye (>=0.3.4, <=0.3.6) potentially affected by unknown CVE via bleach (2.1.2)

bleach PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - alo7-airflow =1.10.0, =0.3.4, =0.3.6 Source cves: unknown CVE Source advisory: OSV:GHSA-GJ48-438W-JH9V...

django-qr-toolkit-core (>=2.7.0, <=3.4.0) potentially affected by unknown CVE via bleach (3.2.2)

bleach PYPI version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - django-qr-toolkit-core =2.7.0, =3.4.0 Source cves: unknown CVE Source advisory: OSV:GHSA-GJ48-438W-JH9V...

canvs-toolbox-canvsuser (>=0.0.9, <=0.1.0), chronix2grid (>=0.1.0rc1, <=1.0.2) +8 more potentially affected by unknown CVE via bleach (3.1.1)

bleach PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - canvs-toolbox-canvsuser =0.0.9, =0.1.0rc1, =1.0.0, =8.1.0, =8.1.99 - momopapa 1.0.1 - pangsitpy 0.0.3 - random-rfe 0.1.0 - spritesheet-bella 1.0.1 -...

colorizexl (>=0.0.1, <=0.2.1), dstrace (>=0.1.5, <=0.1.11) +8 more potentially affected by unknown CVE via bleach (3.1.4)

bleach PYPI version 3.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - colorizexl =0.0.1, =0.1.5, =1.1.7, =8.2.0, =0.0.2, =1.4.0, =0.0.6rc1, =0.3.2, =0.3.3 Source cves: unknown CVE Source advisory: OSV:GHSA-8RFP-98V4-MM...

a2grunnerp (>=0.1.0, <=0.1.8), abilian-sbe-next (1.0.4) +134 more potentially affected by unknown CVE via bleach (5.0.1)

bleach PYPI version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - a2grunnerp =0.1.0, =1.0.3, =6.9.1, =1.0.1, =2022.6.0.post0, =2.0.0a3.dev0, =1.0.0, =2.0.0b0, =2.1.0, =0.1.0.dev0, =2.0.0b0, =1.0.0.dev0, =0.1.0,...

dfio (0.0.3) potentially affected by unknown CVE via bleach (3.2.0)

bleach PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - dfio 0.0.3 Source cves: unknown CVE Source advisory: OSV:GHSA-8RFP-98V4-MMR6...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-54531 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

krummstab (>=0.2.0, <=1.2.1) potentially affected by CVE-2026-54531 via pypdf (3.1.0)

pypdf PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - krummstab =0.2.0, =1.2.1 Source cves: CVE-2026-54531 Source advisory: OSV:GHSA-M2V9-299J-RV96...

agentc-llamaindex (0.2.5a2), agentia (>=0.0.2, <=0.0.10) +245 more potentially affected by CVE-2026-54531 via pypdf (5.9.0)

pypdf PYPI version 5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agentc-llamaindex 0.2.5a2 - agentia =0.0.2, =0.0.1, =0.1.4, =0.1.0a0.dev0, =0.2.0a0, =0.11.2, =1.1.0a20250429, =3.1.8, =1.0.5, =1.0.0, =0.1.0, =1.1.1,...

pymorant (>=1.0.145, <=1.0.156) potentially affected by CVE-2026-54531 via pypdf (3.16.1)

pypdf PYPI version 3.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pymorant =1.0.145, =1.0.156 Source cves: CVE-2026-54531 Source advisory: OSV:GHSA-M2V9-299J-RV96...

ai-enterprise-agent (>=0.0.4, <=0.0.9), almax-common (>=1.0.5.dev20240601224039, <=1.0.7.dev20240801212517) +25 more potentially affected by CVE-2026-54531 via pypdf (4.2.0)

pypdf PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - ai-enterprise-agent =0.0.4, =1.0.5.dev20240601224039, =2024.7.4, =0.6.22, =0.2.1, =0.2.0, =0.0.5, =0.2.1, =3.3.2, =0.1.0, =0.0.1, =4.7.1, =0.1.0, =0.1...