@acabai/android (>=1.0.0, <=1.0.1), @addfox/cli (>=0.1.1-beta.2, <=0.1.1) +179 more potentially affected by CVE-2026-31988 via yauzl (3.2.0)

yauzl NPM version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on yauzl and may be impacted: - @acabai/android =1.0.0, =0.1.1-beta.2, =0.1.1-beta.2, =1.6.10, =3.4.26, =2.1.83, =1.2.7, =1.1.22, =8.0.0, =10.0.0, =10.0.0, =1.0.0, =1.0.1, =8.9.4,...

@24hr/ettapi (>=0.0.1, <=0.2.5), @dzangolab/fastify-s3 (>=0.48.0, <=0.87.0) +1 more potentially affected by CVE-2025-65587 via graphql-upload-minimal (>=1.5.3, <=1.6.1)

graphql-upload-minimal NPM version =1.5.3, =0.0.1, =0.48.0, =0.88.0, =0.93.4 Source cves: CVE-2025-65587 Source advisory: SNYK:JS-GRAPHQLUPLOADMINIMAL-15682460...

@snyk/snyk-cocoapods-plugin (>=2.6.0, <=3.1.1), @snyk/snyk-hex-plugin (>=2.0.0, <=2.2.2) +4 more potentially affected by CVE-2026-32094 via shescape (>=2.1.0, <=2.1.6)

shescape NPM version =2.1.0, =2.6.0, =2.0.0, =8.0.0, =3.0.0, =3.0.0, =3.1.2 Source cves: CVE-2026-32094 Source advisory: SNYK:JS-SHESCAPE-15467452...

@studiocms/migrator (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-32106 via studiocms (>=0.2.0, <=0.3.0)

studiocms NPM version =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2026-32106 Source advisory: SNYK:JS-STUDIOCMS-15666774...

@studiocms/migrator (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-32104 via studiocms (>=0.2.0, <=0.3.0)

studiocms NPM version =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2026-32104 Source advisory: SNYK:JS-STUDIOCMS-15665373...

analysisstore (0.0.5), bluesky-browser (0.1.0a1) +14 more potentially affected by CVE-2026-35536 via tornado (5.0.0b1)

tornado PYPI version 5.0.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - analysisstore 0.0.5 - bluesky-browser 0.1.0a1 - conftrak 0.0.6 - foebackend 1.0.0 - foeworkers 1.0.4 - httpwatcher 0.5.2 - legoman =1.0.0, =0.1....

catsup (>=0.3.8, <=0.3.11), pylocalsmtp (>=0.5.0, <=1.0.0) +1 more potentially affected by CVE-2026-35536 via tornado (3.2.0)

tornado PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - catsup =0.3.8, =0.5.0, =0.1.1, =0.1.2 Source cves: CVE-2026-35536 Source advisory: OSV:GHSA-78CV-MQJ4-43F7...

@aabelmann/ui-layer (0.0.1), @adinvadim/convex-vue (>=1.1.0, <=1.3.0) +721 more potentially affected by CVE-2026-30226 via devalue (>=4.0.1, <=5.6.3)

devalue NPM version =4.0.1, =1.1.0, =1.0.0, =0.2.2, =0.2.2, =0.2.2, =0.3.0, =0.5.7, =0.0.1-beta.3, =0.0.1-alpha.1, =0.0.17, =0.0.2, =0.0.1, =0.2.0 - @astro-component/button 0.0.1 and more Source cves: CVE-2026-30226 Source advisory: SNYK:JS-DEVALUE-15467451...

bokcolmaps (>=0.1.0, <=0.2.1), bokodapviewer (>=0.1.0, <=0.1.1) +8 more potentially affected by CVE-2026-31958 via tornado (4.4.2)

tornado PYPI version 4.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - bokcolmaps =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.8.4, =0.1.7, =0.0.1, =0.0.14 Source cves: CVE-2026-31958 Source advisory: OSV:PYSEC-2026-140...

analysisstore (0.0.5), bluesky-browser (0.1.0a1) +14 more potentially affected by CVE-2026-31958 via tornado (5.0.0b1)

tornado PYPI version 5.0.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - analysisstore 0.0.5 - bluesky-browser 0.1.0a1 - conftrak 0.0.6 - foebackend 1.0.0 - foeworkers 1.0.4 - httpwatcher 0.5.2 - legoman =1.0.0, =0.1....

featuren (0.1.0), pybana (0.1.0) potentially affected by CVE-2026-31900 via black (18.6.0b4)

black PYPI version 18.6.0b4 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - featuren 0.1.0 - pybana 0.1.0 Source cves: CVE-2026-31900 Source advisory: OSV:PYSEC-2026-2120...

airfly (>=0.6.0, <=0.6.3), airpyllution (>=0.2.0, <=2.0.1) +105 more potentially affected by CVE-2026-31900 via black (21.12.0b0)

black PYPI version 21.12.0b0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - airfly =0.6.0, =0.2.0, =3.0.2, =0.0.3, =0.1.0, =1.0.0, =0.6.5, =2021.0.0, =0.8.2, =0.2.6, =0.1.2, =0.1.3 and more Source cves: CVE-2026-31900 Sour...

aiosoma (1.1.18), candlestick-patterns (>=1.0.1, <=1.2.0) +3 more potentially affected by CVE-2026-31900 via black (23.12.0)

black PYPI version 23.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - aiosoma 1.1.18 - candlestick-patterns =1.0.1, =0.1.9, =2.97.0, =0.39.0, =0.39.6 Source cves: CVE-2026-31900 Source advisory: OSV:PYSEC-2026-2120...

org.keycloak:keycloak-authz-policy-drools (8.0.0), org.keycloak:keycloak-dependencies-server-all (8.0.0) +7 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (8.0.0)

org.keycloak:keycloak-services MAVEN version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 8.0.0 - org.keycloak:keycloak-dependencies-server-all 8.0...

com.buschmais.jqassistant.cli:application (>=1.7.0-rc1, <=2.10.0-m4), com.buschmais.jqassistant.cli:jqassistant-commandline-distribution (>=2.0.0-m3, <=2.0.10) +112 more potentially affected by CVE-2026-1524 via org.neo4j.community:it-test-support (>=3.5.0-beta02, <=5.26.21)

org.neo4j.community:it-test-support MAVEN version =3.5.0-beta02, =1.7.0-rc1, =2.0.0-m3, =1.7.0-rc1, =2.1.0-m1, =2.1.0-m1, =1.7.0-rc1, =1.7.0-rc1, =1.12.0-m1, =2.4.0-m1, =1.7.0-rc1, =1.10.0-alpha1, =2.0.0-rc2, =1.7.0-rc1, =1.7.0-rc1, =1.12.0-m1, =2.10.0-m4 and more Source cves: CVE-2026-1524 Sourc...

adi (>=0.7.0, <=0.13.0-pre2), adi_gpu (>=0.7.0, <=0.11.0) +437 more potentially affected by unknown CVE via cgmath (>=0.1.5, <=0.18.0)

cgmath CARGO version =0.1.5, =0.7.0, =0.7.0, =0.8.0, =0.6.0, =0.5.3, =0.8.0, =0.1.0, =0.4.0, =0.2.0, =0.4.0, =0.5.0, =0.5.2, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0197...

acril (0.1.0), acril-http (0.1.0) +909 more potentially affected by unknown CVE via http-types (>=1.3.1, <=2.12.0)

http-types CARGO version =1.3.1, =4.0.0, =0.1.0, =0.1.0, =0.3.0, =0.10.0, =0.3.0, =0.1.0, =0.1.0, =0.6.0, =0.0.1, =0.2.0, =0.7.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0174...

fr.cnieg.keycloak:attribute-login-provider (1.3.8), io.phasetwo.keycloak:keycloak-extensions (0.1) +24 more potentially affected by CVE-2026-3911 via org.keycloak:keycloak-services (22.0.3)

org.keycloak:keycloak-services MAVEN version 22.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.8 - io.phasetwo.keycloak:keycloak-extensions 0.1 -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=2.5.3-23.0, <=2.5.5-23.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.3-23.0, <=2.5.5-23.0) +24 more potentially affected by CVE-2026-3911 via org.keycloak:keycloak-services (23.0.7)

org.keycloak:keycloak-services MAVEN version 23.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =2.5.3-23.0, =2.5.3-23.0, =0.58, =0.66 -...

@agentforce/adk (>=0.9.0, <=0.12.1), @agentkit-ai/bff-hono (1.0.0) +503 more potentially affected by unknown CVE via hono (>=4.0.0, <=4.12.6)

hono NPM version =4.0.0, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =0.0.31 and more Source cves: unknown CVE Source advisory: SNYK:JS-HONO-15459469...