@1delta/aggregators (>=0.1.0, <=0.1.6), @1delta/bridge-configs (>=0.1.0, <=0.1.9) +1915 more potentially affected by CVE-2025-64756 via glob (>=10.3.7, <=10.4.5)

glob NPM version =10.3.7, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.0.0, =0.8.1, =1.0.0, =1.0.0, =1.0.0, =1.0.9, =1.0.15 and more Source cves: CVE-2025-64756 Source advisory: SNYK:JS-GLOB-14040952...

1k-tasks (>=4.0.0, <=4.2.2), @514labs/sloan-mcp (0.0.68) +1189 more potentially affected by CVE-2025-64756 via glob (>=11.0.0, <=11.0.3)

glob NPM version =11.0.0, =4.0.0, =0.1.0, =4.10.0, =16.5.13, =1.0.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.5-alpha.2, =0.1.4-alpha.0, =0.1.1, =0.1.6 and more Source cves: CVE-2025-64756 Source advisory: SNYK:JS-GLOB-14040952...

1k-tasks (>=3.3.0, <=3.6.1), @1delta/aggregators (>=0.1.0, <=0.1.6) +2278 more potentially affected by CVE-2025-64756 via glob (>=10.2.1, <=10.4.5)

glob NPM version =10.2.1, =3.3.0, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.0.0, =0.8.1, =1.0.0, =1.0.0, =1.0.1 - @aaronngray/typeorm-seeding 6.0.1 - @abasync/eslint-config 1.1.0 - @abc45676/mailer 1.0.0 and more Source cves: CVE-2025-64756 Source advisory:...

abe_gpsw (>=0.2.4, <=2.0.0), abstract-boot (>=0.2.0-beta.4, <=0.2.0-beta.7) +2546 more potentially affected by unknown CVE via gcc (>=0.3.35, <=0.3.55)

gcc CARGO version =0.3.35, =0.2.4, =0.2.0-beta.4, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.0.1, =0.0.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0121...

ab-av1 (>=0.1.0, <=0.4.3), ablavema (0.4.2) +1351 more potentially affected by unknown CVE via number_prefix (>=0.2.8, <=0.4.0)

numberprefix CARGO version =0.2.8, =0.1.0, =0.1.0, =0.0.6, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.1, =0.1.0, =0.1.0, =0.1.7, =1.1.0, =0.1.0, =0.15.0, =0.1.0, =0.8.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0119...

actix-web-opentelemetry (>=0.2.0, <=0.11.0-beta.3), atomic-server (>=0.32.1, <=0.34.0) +42 more potentially affected by unknown CVE via opentelemetry-jaeger (>=0.1.0, <=0.22.0)

opentelemetry-jaeger CARGO version =0.1.0, =0.2.0, =0.32.1, =0.2.1, =4.1.0, =0.1.0, =0.6.1, =0.4.0-prerelease1, =0.3.2-rc2, =0.2.0-rc-10, =0.2.0-rc-10, =0.2.0-rc-10, =0.2.0-rc, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0123...

a2 (>=0.3.6, <=0.5.0-alpha.1), abd-clam (>=0.22.6, <=0.30.0) +5688 more potentially affected by unknown CVE via rand_os (>=0.1.3, <=0.2.2)

randos CARGO version =0.1.3, =0.3.6, =0.22.6, =0.1.0, =0.4.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.3, =0.0.1, =0.0.7-alpha.3, =0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0124...

swift-scality-backend (0.4.4) potentially affected by CVE-2025-65073 via swift (2.38.1)

swift PYPI version 2.38.1 is affected by a known vulnerability. The following packages have a transitive dependency on swift and may be impacted: - swift-scality-backend 0.4.4 Source cves: CVE-2025-65073 Source advisory: SNYK:PYTHON-SWIFT-14038401...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by unknown CVE via @apollo/composition (>=2.10.0, <=2.10.3)

@apollo/composition NPM version =2.10.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2025-64172 via @apollo/composition (>=2.3.0, <=2.9.4)

@apollo/composition NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2025-64172 Source advisory: SNYK:JS-APOLLOCOMPOSITION-14038234...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by unknown CVE via @apollo/composition (2.12.0-preview.4)

@apollo/composition NPM version 2.12.0-preview.4 is affected by a known vulnerability. The following packages have a transitive dependency on @apollo/composition and may be impacted: - @apollo/gateway =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: unknown CVE Source advisory:...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2025-64172 via @apollo/composition (>=2.10.0, <=2.10.3)

@apollo/composition NPM version =2.10.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2025-64172 Source advisory: SNYK:JS-APOLLOCOMPOSITION-14038234...

@apollo/gateway (>=2.11.0-preview.0, <=2.11.4), @dfanchon/gateway (2.11.0) +1 more potentially affected by unknown CVE via @apollo/composition (>=2.11.0, <=2.11.4)

@apollo/composition NPM version =2.11.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

EUVD-2025-197661

Apollo Federation has Improper Enforcement of Access Control on Transitive Fields...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by unknown CVE via @apollo/composition (>=2.3.0, <=2.9.4)

@apollo/composition NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

@apollo/gateway (>=2.11.0-preview.0, <=2.11.4), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2025-64172 via @apollo/composition (>=2.11.0, <=2.11.4)

@apollo/composition NPM version =2.11.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: CVE-2025-64172 Source advisory: SNYK:JS-APOLLOCOMPOSITION-14038234...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2025-64172 via @apollo/composition (2.12.0-preview.4)

@apollo/composition NPM version 2.12.0-preview.4 is affected by a known vulnerability. The following packages have a transitive dependency on @apollo/composition and may be impacted: - @apollo/gateway =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: CVE-2025-64172 Source advisory:...

GHSA-M8JR-FXQX-8XX6 Apollo Federation has Improper Enforcement of Access Control on Transitive Fields

Summary A vulnerability in Apollo Federation's composition logic did not enforce that fields depending on protected data through @requires and/or @fromContext directives have the same access control requirements as the fields they reference. This allowed queries to access protected fields...

Apollo Federation has Improper Enforcement of Access Control on Transitive Fields

Summary A vulnerability in Apollo Federation's composition logic did not enforce that fields depending on protected data through @requires and/or @fromContext directives have the same access control requirements as the fields they reference. This allowed queries to access protected fields...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @directus/api (>=20.0.0-rc.0, <=31.0.0) +1 more potentially affected by CVE-2025-64747 via directus (>=11.0.0, <=11.12.0)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =31.0.0 - @fahami/directus-pkce 1.0.0 Source cves: CVE-2025-64747 Source advisory: OSV:GHSA-VV2V-PW69-8CRF...