@8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4), @accelbyte/sdk-legal (>=0.0.0-dev-20241106153220, <=6.3.2) +1042 more potentially affected by CVE-2025-15599 via dompurify (>=3.1.3, <=3.2.6)

dompurify NPM version =3.1.3, =0.18.0-beta.0, =0.0.0-dev-20241106153220, =1.0.0, =4.4.0-rc1, =6.4.23, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.2, =1.0.0, =0.1.1, =0.1.5-alpha.2, =0.1.1, =0.1.6 and more Source cves: CVE-2025-15599 Source advisory: OSV:GHSA-V8JM-5VWX-CFXM...

@atlassian/aui (>=9.3.22, <=10.0.0-M02), @charcoal-ui/icons (>=3.16.0, <=3.21.0) +116 more potentially affected by CVE-2026-0540 via dompurify (>=2.5.4, <=2.5.8)

dompurify NPM version =2.5.4, =9.3.22, =3.16.0, =3.0.0-beta.0, =3.0.0-beta.0, =0.0.0-canary-20240806060533, =0.0.0-canary-20240806060533, =0.0.0-canary-20240806060533, =0.0.0-canary-20240806060533, =0.0.0-canary-20240719153432, =0.0.0-fec-156-react19-20250116105607,...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +1855 more potentially affected by CVE-2026-0540 via dompurify (>=3.1.3, <=3.3.1)

dompurify NPM version =3.1.3, =0.3.96, =0.5.12, =0.3.33, =0.5.0, =0.4.71, =1.0.0, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20241106153220, =1.0.0, =1.0.35 and more Source cves: CVE-2026-0540 Source advisory: OSV:GHSA-V2WJ-7WPQ-C8VV...

@atlassian/aui (>=9.3.22, <=10.0.0-M02), @charcoal-ui/icons (>=3.16.0, <=3.21.0) +116 more potentially affected by CVE-2025-15599 via dompurify (>=2.5.4, <=2.5.8)

dompurify NPM version =2.5.4, =9.3.22, =3.16.0, =3.0.0-beta.0, =3.0.0-beta.0, =0.0.0-canary-20240806060533, =0.0.0-canary-20240806060533, =0.0.0-canary-20240806060533, =0.0.0-canary-20240806060533, =0.0.0-canary-20240719153432, =0.0.0-fec-156-react19-20250116105607,...

ai-dynamo (>=0.1.0, <=0.3.0), bento-sgl-router (>=0.0.1, <=0.0.6) +31 more potentially affected by CVE-2026-27905 via bentoml (>=0.9.2, <=1.4.39)

bentoml PYPI version =0.9.2, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.2.3, =0.0.1, =0.0.10, =0.1.0, =0.2.0, =0.0.1, =0.3.12.dev20240709150559, =0.3.52 and more Source cves: CVE-2026-27905 Source advisory: SNYK:PYTHON-BENTOML-15372202...

-react-file-list-components (1.1.1), 01basicreact (>=0.1.0, <=0.1.9) +59233 more potentially affected by CVE-2026-27601 via underscore (>=1.0.3, <=1.13.7)

underscore NPM version =1.0.3, =0.1.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 - 0scarclassi 1.0.1 - 0scarclassj 1.0.1 and more Source cves:...

-react-file-list-components (1.1.1), 01basicreact (>=0.1.0, <=0.1.9) +59233 more potentially affected by CVE-2026-27601 via underscore (>=1.0.3, <=1.13.7)

underscore NPM version =1.0.3, =0.1.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 - 0scarclassi 1.0.1 - 0scarclassj 1.0.1 and more Source cves:...

org.glassfish.mq:mq-client (>=6.4.0, <=6.9.0), org.glassfish.mq:mq-cluster (>=6.4.0, <=6.9.0) +12 more potentially affected by CVE-2026-22886 via org.glassfish.mq:mqbroker-core (>=6.4.0, <=6.9.0)

org.glassfish.mq:mqbroker-core MAVEN version =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.9.0 Source cves: CVE-2026-22886 Source advisory: SNYK:JAVA-ORGGLASSFISHMQ-15444256...

@activeboxes/piece-gmail (0.8.1), @activeboxes/piece-imap (0.2.10) +77 more potentially affected by CVE-2026-3455 via mailparser (>=3.0.0, <=3.9.1)

mailparser NPM version =3.0.0, =0.6.0, =0.0.1, =0.0.1, =1.0.0, =0.5.0, =1.0.64-alpha, =1.0.21-alpha, =4.0.1-alpha, =6.1.180-alpha and more Source cves: CVE-2026-3455 Source advisory: OSV:GHSA-7GMJ-H9XC-MCXC...

@activepieces/piece-snowflake (>=0.2.1, <=0.3.0), @bhanu17/nextjs-starter (>=1.2.0, <=2.2.14) +102 more potentially affected by CVE-2026-3449 via @tootallnate/once (2.0.0)

@tootallnate/once NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @tootallnate/once and may be impacted: - @activepieces/piece-snowflake =0.2.1, =1.2.0, =0.0.18, =0.2.0, =0.0.6, =0.0.1, =50.32.5-depup.0, =0.6.0, =0.4.2, =0.1.10,...

@amqp-contract/asyncapi (>=0.2.0, <=0.20.0), @bgd-labs/indexer-client (>=1.23.1, <=1.42.1) +49 more potentially affected by CVE-2026-28794 via @orpc/client (>=1.0.0-beta.1, <=1.13.5)

@orpc/client NPM version =1.0.0-beta.1, =0.2.0, =1.23.1, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.0-beta.20, =0.1.21, =0.1.0, =0.1.9, =0.4.2, =0.0.0, =1.13.5 and more Source cves: CVE-2026-28794 Source advisory:...

@amqp-contract/asyncapi (>=0.2.0, <=0.20.0), @bgd-labs/indexer-client (>=1.23.1, <=1.42.1) +49 more potentially affected by CVE-2026-28794 via @orpc/client (>=1.0.0-beta.1, <=1.13.5)

@orpc/client NPM version =1.0.0-beta.1, =0.2.0, =1.23.1, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.0-beta.20, =0.1.21, =0.1.0, =0.1.9, =0.4.2, =0.0.0, =1.13.5 and more Source cves: CVE-2026-28794 Source advisory:...

@qwikui-org/ui (>=0.2.2, <=0.2.3), @react-portable/core (>=0.4.0, <=0.11.2) +1 more potentially affected by CVE-2026-27971 via @builder.io/qwik (>=1.2.6, <=1.4.5)

@builder.io/qwik NPM version =1.2.6, =0.2.2, =0.4.0, =0.11.2 - not-qwik-library-test1 0.0.3 Source cves: CVE-2026-27971 Source advisory: SNYK:JS-BUILDERIOQWIK-15369137...

@dyyxyzz/baileys-mod (>=6.0.32, <=6.0.54) potentially affected by unknown CVE via @daffadeveloper/libsignal-node (0.0.1-security)

@daffadeveloper/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @daffadeveloper/libsignal-node and may be impacted: - @dyyxyzz/baileys-mod =6.0.32, =6.0.54 Source cves: unknown CVE Source advisory:...

@dyyxyzz/baileys-mod (>=6.0.32, <=6.0.54) potentially affected by unknown CVE via @daffadeveloper/libsignal-node (0.0.1-security)

@daffadeveloper/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @daffadeveloper/libsignal-node and may be impacted: - @dyyxyzz/baileys-mod =6.0.32, =6.0.54 Source cves: unknown CVE Source advisory:...

@goldenqueen/bai (>=1.0.0, <=1.0.3), @khineeyouu/baileys (>=0.2.1, <=0.2.24) +10 more potentially affected by unknown CVE via @yaoii-bails/libsignall-node (0.0.1-security)

@yaoii-bails/libsignall-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @yaoii-bails/libsignall-node and may be impacted: - @goldenqueen/bai =1.0.0, =0.2.1, =2.0.16, =17.1.12, =1.0.13, =1.0.23, =1.0.24 - nopedorex 1.0.0 ...

@goldenqueen/bai (>=1.0.0, <=1.0.3), @khineeyouu/baileys (>=0.2.1, <=0.2.24) +10 more potentially affected by unknown CVE via @yaoii-bails/libsignall-node (0.0.1-security)

@yaoii-bails/libsignall-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @yaoii-bails/libsignall-node and may be impacted: - @goldenqueen/bai =1.0.0, =0.2.1, =2.0.16, =17.1.12, =1.0.13, =1.0.23, =1.0.24 - nopedorex 1.0.0 ...

jwts (>=0.5.0, <=0.5.1), rustls-webpki (>=0.102.2, <=0.102.8) potentially affected by CVE-2026-3337 via aws-lc-sys (>=0.14.1, <=0.21.0)

aws-lc-sys CARGO version =0.14.1, =0.5.0, =0.102.2, =0.102.8 Source cves: CVE-2026-3337 Source advisory: OSV:RUSTSEC-2026-0045...

dbgpt-app (0.8.0rc1), dbgpt-client (>=0.7.0rc0, <=0.8.2) +2 more potentially affected by CVE-2026-3409 via dbgpt (0.8.2)

dbgpt PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on dbgpt and may be impacted: - dbgpt-app 0.8.0rc1 - dbgpt-client =0.7.0rc0, =0.7.0rc0, =0.8.0rc1, =0.8.2 Source cves: CVE-2026-3409 Source advisory: SNYK:PYTHON-DBGPT-15426547...

4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1512 more potentially affected by CVE-2026-3304 via multer (>=2.0.0, <=2.0.2)

multer NPM version =2.0.0, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =0.6.2 and more Source cves: CVE-2026-3304 Source advisory: OSV:GHSA-XF7R-HGR6-V32P...