@accordproject/cicero-cli (>=0.23.0-20220318211856, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.23.0-20220318211856, <=0.24.1-20230627140514) +182 more potentially affected by CVE-2026-92948 via vm2 (>=3.9.6, <=3.11.6)

vm2 NPM version =3.9.6, =0.23.0-20220318211856, =0.23.0-20220318211856, =0.23.0-20220318211856, =0.23.0-20220318211856, =0.23.0-20220318211856, =0.23.0-20220317205016, =0.23.0-20220317205016, =0.23.0-20220317205016, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =0.1.0, =0.0.2, =1.0.2, =3.0.34 and more Source...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +291 more potentially affected by CVE-2026-92947 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@cairncms/api (>=1.0.0-beta.1, <=1.0.0-beta.4), @dataform/cli (>=3.0.46, <=3.0.71) +24 more potentially affected by CVE-2026-92956 via vm2 (>=3.10.1, <=3.11.6)

vm2 NPM version =3.10.1, =1.0.0-beta.1, =3.0.46, =0.1.0, =2.32.0, =1.0.0, =1.1.15, =1.27.8, =1.0.0-beta.1, =1.1.0, =0.2.0, =2.32.0, =2.33.7 and more Source cves: CVE-2026-92956 Source advisory: SNYK:JS-VM2-20043663...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +291 more potentially affected by CVE-2026-92959 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +291 more potentially affected by CVE-2026-92934 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +291 more potentially affected by CVE-2026-92945 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

GHSA-8MVV-MCC3-XWHH Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7q3f-wx44-378m. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string...

@acmekit/acmekit-oas-cli (>=2.13.1, <=2.13.94), @apifactory/openapi-builder (>=1.0.0, <=1.0.5) +7 more potentially affected by CVE-2026-63225 via @redocly/cli (>=1.0.0-beta.123, <=1.34.5)

@redocly/cli NPM version =1.0.0-beta.123, =2.13.1, =1.0.0, =0.2.2-next-20230413194207, =1.3.33, =8.0.1-fix-binary-778dccce.0, =1.2.13, =2.15.5, =2.16.3 Source cves: CVE-2026-63225 Source advisory: OSV:GHSA-657C-G7QC-R9J2...

promptulate (1.9.0) potentially affected by CVE-2026-59823 via litellm (0.12.12)

litellm PYPI version 0.12.12 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - promptulate 1.9.0 Source cves: CVE-2026-59823 Source advisory: OSV:GHSA-HX8V-G79F-8W5F...

fastrepl (>=0.0.21, <=0.0.25), funcflow (0.0.3) +2 more potentially affected by CVE-2026-59823 via litellm (0.8.6)

litellm PYPI version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - fastrepl =0.0.21, =0.0.5, =0.0.9 Source cves: CVE-2026-59823 Source advisory: OSV:GHSA-HX8V-G79F-8W5F...

aiconsole (>=0.2.0, <=0.2.7), fastrepl (>=0.0.19, <=0.0.20) potentially affected by CVE-2026-59823 via litellm (0.6.6)

litellm PYPI version 0.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - aiconsole =0.2.0, =0.0.19, =0.0.20 Source cves: CVE-2026-59823 Source advisory: OSV:GHSA-HX8V-G79F-8W5F...

vimgpt (0.1.2) potentially affected by CVE-2026-59823 via litellm (0.1.618)

litellm PYPI version 0.1.618 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - vimgpt 0.1.2 Source cves: CVE-2026-59823 Source advisory: OSV:GHSA-HX8V-G79F-8W5F...

CVE-2026-92945: Improper Limitation of a Pathname to a Restricted Directory

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

PT-2026-105498

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7q3f-wx44-378m. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string...

@0xsequence/web3-onboard-plugin (2.0.5), @0xzoz/tallyho (>=2.0.11, <=2.0.14) +1769 more potentially affected by CVE-2026-92599 via joi (>=17.2.0, <=17.13.6)

joi NPM version =17.2.0, =2.0.11, =0.1.6-alpha.2, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.16.17-beta-0213b250, =1.8.31, =1.1.12, =1.7.1, =1.8.31, =1.0.0, =1.16.34-beta-20241113-102431-65542b84 and more Source cves: CVE-2026-92599 Source advisory: SNYK:JS-JOI-19883907...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +55 more potentially affected by CVE-2026-68904 via node-opcua-client (>=2.10.0, <=2.169.0)

node-opcua-client NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.3.2-alpha.86, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.183, =1.4.15-alpha.61, =1.3.6-alpha.36, =1.4.15-alpha.159, =1.3.5, =1.4.15-alpha.197, =1.4.15-alpha.279, =1.4.15-alpha.182, =1.4.15-alpha.196 and more Source cves:...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), au.com.versent.jenkins.plugins:ignore-committer-strategy (>=29.v7c3891a_434c3, <=63.v7e87d06b_a_30c) +424 more potentially affected by CVE-2026-92129 via org.jenkins-ci.plugins:script-security (>=1.4, <=1415.v9a_f9b_3a_c253d)

org.jenkins-ci.plugins:script-security MAVEN version =1.4, =29.v7c3891a434c3, =2.33.0, =4.1.0.506.v619d63bec9d8, =1.0.5.0, =0.2, =198.vfe106798d1a6, =66.v12c841920f7d, =1.9.2-beta, =1.151.vbca71ddd0bcf, =1.29, =1.28.0, =61.v68bd7264b643, =73.ve2b957fc2921 and more Source cves: CVE-2026-92129 Sour...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), au.com.versent.jenkins.plugins:ignore-committer-strategy (>=29.v7c3891a_434c3, <=63.v7e87d06b_a_30c) +424 more potentially affected by CVE-2026-92128 via org.jenkins-ci.plugins:script-security (>=1.4, <=1415.v9a_f9b_3a_c253d)

org.jenkins-ci.plugins:script-security MAVEN version =1.4, =29.v7c3891a434c3, =2.33.0, =4.1.0.506.v619d63bec9d8, =1.0.5.0, =0.2, =198.vfe106798d1a6, =66.v12c841920f7d, =1.9.2-beta, =1.151.vbca71ddd0bcf, =1.29, =1.28.0, =61.v68bd7264b643, =73.ve2b957fc2921 and more Source cves: CVE-2026-92128 Sour...

@aliceo2/bookkeeping (>=1.19.0, <=1.20.0), @beyondnet/evolith-cli (>=1.2.0, <=1.3.2) +68 more potentially affected by CVE-2026-88932 via multer (>=2.2.0, <=2.3.0)

multer NPM version =2.2.0, =1.19.0, =1.2.0, =1.2.0, =2026.7.0, =5.7.5, =11.1.29-depup.0, =0.1.0, =0.1.0, =11.0.62, =1.2.34, =12.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2026-88932 Source advisory: SNYK:JS-MULTER-19785644...

@0xsequence/web3-onboard-plugin (2.0.5), @0xzoz/tallyho (>=2.0.11, <=2.0.14) +1777 more potentially affected by CVE-2026-90771 via joi (>=17.1.1, <=17.13.7)

joi NPM version =17.1.1, =2.0.11, =0.1.6-alpha.2, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.16.17-beta-0213b250, =1.8.31, =1.1.12, =1.7.1, =1.8.31, =1.0.0, =1.16.34-beta-20241113-102431-65542b84 and more Source cves: CVE-2026-90771 Source advisory: SNYK:JS-JOI-19778379...