airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2025-65995 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2025-65995 Source advisory: OSV:GHSA-GFW7-2V73-69WG...

org.webjars.npm:jsrsasign-util (1.0.5) potentially affected by CVE-2026-4603 via org.webjars.npm:jsrsasign (11.1.0)

org.webjars.npm:jsrsasign MAVEN version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:jsrsasign and may be impacted: - org.webjars.npm:jsrsasign-util 1.0.5 Source cves: CVE-2026-4603 Source advisory:...

@atomicservice/ascf-toolkit (>=1.0.0, <=1.0.17), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.17) +77 more potentially affected by CVE-2026-4603 via jsrsasign (>=11.0.0, <=11.1.0)

jsrsasign NPM version =11.0.0, =1.0.0, =1.0.1-beta.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.8.3 - @citrineos/ocpi-base 2.0.1 - @citrineos/ocpi-cdrs 2.0.1 - @citrineos/ocpi-charging-profiles 2.0.1 - @citrineos/ocpi-commands 2.0.1 - @citrineos/ocpi-credentials 2.0.1 - @citrineos/ocpi-locations 2.0.1 -...

org.webjars.npm:jsrsasign-util (1.0.5) potentially affected by CVE-2026-4602 via org.webjars.npm:jsrsasign (11.1.0)

org.webjars.npm:jsrsasign MAVEN version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:jsrsasign and may be impacted: - org.webjars.npm:jsrsasign-util 1.0.5 Source cves: CVE-2026-4602 Source advisory:...

@atomicservice/ascf-toolkit (>=1.0.0, <=1.0.17), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.17) +77 more potentially affected by CVE-2026-4602 via jsrsasign (>=11.0.0, <=11.1.0)

jsrsasign NPM version =11.0.0, =1.0.0, =1.0.1-beta.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.8.3 - @citrineos/ocpi-base 2.0.1 - @citrineos/ocpi-cdrs 2.0.1 - @citrineos/ocpi-charging-profiles 2.0.1 - @citrineos/ocpi-commands 2.0.1 - @citrineos/ocpi-credentials 2.0.1 - @citrineos/ocpi-locations 2.0.1 -...

mlsquare (0.2.1) potentially affected by CVE-2026-27482 via ray (0.6.5)

ray PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - mlsquare 0.2.1 Source cves: CVE-2026-27482 Source advisory: OSV:GHSA-Q5FH-2HC8-F6RQ...

deepnlpf (>=0.0.18, <=0.0.20) potentially affected by CVE-2026-27482 via ray (1.11.0)

ray PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - deepnlpf =0.0.18, =0.0.20 Source cves: CVE-2026-27482 Source advisory: OSV:GHSA-Q5FH-2HC8-F6RQ...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1081 more potentially affected by CVE-2026-25896 via fast-xml-parser (>=5.0.1, <=5.3.4)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-25896 Source advisory: SNYK:JS-FASTXMLPARSER-15324289...

5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +3946 more potentially affected by CVE-2026-25896 via fast-xml-parser (>=4.1.3, <=4.5.3)

fast-xml-parser NPM version =4.1.3, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2026-25896 Source advisory: SNYK:JS-FASTXMLPARSER-15324289...

5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +3946 more potentially affected by CVE-2026-25896 via fast-xml-parser (>=4.1.3, <=4.5.3)

fast-xml-parser NPM version =4.1.3, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2026-25896 Source advisory: OSV:GHSA-M7JM-9GC2-MPF2...

com.netflix.ndbench:ndbench-cli (>=0.3.12, <=0.7.4), com.netflix.ndbench:ndbench-geode-plugins (>=0.3.5, <=0.7.4) +35 more potentially affected by CVE-2026-2818 via org.springframework.data:spring-data-geode (>=1.0.0.incubating-release, <=2.7.18)

org.springframework.data:spring-data-geode MAVEN version =1.0.0.incubating-release, =0.3.12, =0.3.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =3.0.0, =3.2.1...

1inch-agent-kit (1.0.53), 1matrix-amino (>=1.0.0, <=1.0.1) +4502 more potentially affected by CVE-2026-2739 via bn.js (>=5.0.0, <=5.2.2)

bn.js NPM version =5.0.0, =1.0.0, =1.0.1, =1.0.1, =1.0.0, =1.0.1, =1.0.0, =1.0.1, =1.0.1, =1.0.2 and more Source cves: CVE-2026-2739 Source advisory: OSV:GHSA-378V-28HJ-76WF...

003-gas-convert (1.0.1), 01-local-payment-flow (1.0.0) +13515 more potentially affected by CVE-2026-2739 via bn.js (>=4.5.2, <=4.12.0)

bn.js NPM version =4.5.2, =1.0.0-3, =0.0.3, =0.0.3, =0.0.11, =1.1.0, =1.1.1 and more Source cves: CVE-2026-2739 Source advisory: OSV:GHSA-378V-28HJ-76WF...

a-api-server (1.3.0), abi-ds-utils (1.0.1) +404 more potentially affected by CVE-2026-27205 via flask (2.2.5)

flask PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - a-api-server 1.3.0 - abi-ds-utils 1.0.1 - acceldata-o2a 1.0.0 - acryl-datahub-airflow-plugin =0.10.5.2rc3, =0.12.0, =0.2.1, =1.0.77, =0.8.2, =0.0.1,...

gief (0.0.3), larigira (>=0.2.0, <=1.3.3) +1 more potentially affected by CVE-2026-27205 via flask (0.11.0)

flask PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - gief 0.0.3 - larigira =0.2.0, =0.0.11, =1.0.5 Source cves: CVE-2026-27205 Source advisory: OSV:GHSA-68RP-WP8R-4726...

gym-http-server (0.0.1), komand (3.2.0) +1 more potentially affected by CVE-2026-27205 via flask (0.12.3)

flask PYPI version 0.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - gym-http-server 0.0.1 - komand 3.2.0 - shrunk 0.6.1 Source cves: CVE-2026-27205 Source advisory: OSV:GHSA-68RP-WP8R-4726...

@hotosm/id (>=2.18.1, <=2.34.0), @janefeel/id (>=2.35.0-dev, <=2.35.23) +6 more potentially affected by CVE-2026-27210 via pannellum (2.5.6)

pannellum NPM version 2.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on pannellum and may be impacted: - @hotosm/id =2.18.1, =2.35.0-dev, =2.35.25, =2.18.5, =2.1.0, =2.33.0, =2.34.2 Source cves: CVE-2026-27210 Source advisory: OSV:GHSA-8423-W5WX-H2...

@hotosm/id (>=2.18.1, <=2.34.0), @janefeel/id (>=2.35.0-dev, <=2.35.23) +6 more potentially affected by CVE-2026-27210 via pannellum (2.5.6)

pannellum NPM version 2.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on pannellum and may be impacted: - @hotosm/id =2.18.1, =2.35.0-dev, =2.35.25, =2.18.5, =2.1.0, =2.33.0, =2.34.2 Source cves: CVE-2026-27210 Source advisory:...

kyoukai (>=2.2.0, <=2.2.1), mezmorize (>=0.18.1, <=0.25.0) +2 more potentially affected by CVE-2026-27199 via werkzeug (0.13.0)

werkzeug PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - kyoukai =2.2.0, =0.18.1, =0.49.2, =0.0.0.1, =0.0.3 Source cves: CVE-2026-27199 Source advisory: OSV:GHSA-29VQ-49WR-VM6X...

aiida-core (>=2.1.0, <=2.2.2), sepal-ui (>=2.10.3, <=2.13.0) potentially affected by CVE-2026-27199 via werkzeug (2.2.0a1)

werkzeug PYPI version 2.2.0a1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - aiida-core =2.1.0, =2.10.3, =2.13.0 Source cves: CVE-2026-27199 Source advisory: OSV:GHSA-29VQ-49WR-VM6X...