app-state (>=0.3.0 <=2.0.1), grasshopper-framework (=0.0.0-alpha.5) +3 more potentially affected by unknown CVE via get-setter (=0.0.0)

get-setter NPM version =0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on get-setter and may be impacted: - app-state =0.3.0, =0.0.0, =0.0.1 - immutable-model-object =0.0.0 - model-object =0.0.0 Source cves: unknown CVE Source advisory:...

2max-express-authenticate (>=0.0.1 <=0.0.122), @0x18b2ee/parse-server (>=3.10.1 <=3.11.0) +2200 more potentially affected by CVE-2020-7689 via bcrypt (>=0.2.4 <=4.0.1)

bcrypt NPM version =0.2.4, =0.0.1, =3.10.1, =1.0.0, =0.0.1, =0.1.0-beta.0, =1.2.0, =1.0.30, =2.0.0, =2.0.1, =0.1.0, =1.0.0, =0.0.1, =0.0.1, =0.0.4 - @aifedespaix/fdp-api-libs =1.0.7 and more Source cves: CVE-2020-7689 Source advisory: OSV:GHSA-5WG4-74H6-Q47V...

aiida-graphql (>=0.0.1 <=0.0.2), annhub-python (>=0.1.5 <=0.1.6) +31 more potentially affected by CVE-2020-7694 via uvicorn (>=0.10.0 <=0.11.5)

uvicorn PYPI version =0.10.0, =0.0.1, =0.1.5, =1.0.0, =22.70.0, =0.31.0, =0.0.14, =0.8.0, =2.0.0, =1.0.0a1, =0.0.2, =0.0.1a0, =0.0.1a1 and more Source cves: CVE-2020-7694 Source advisory: OSV:GHSA-33C7-2MPW-HG34...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.2 <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +35848 more potentially affected by CVE-2020-11612 via io.netty:netty-handler (>=4.1.0.Beta1 <=4.1.45.Final)

io.netty:netty-handler MAVEN version =4.1.0.Beta1, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.28.0 and more Source cves:...

be.cylab.mark:example (>=0.0.22 <=0.0.28), be.cylab.mark:server (>=0.0.10 <=0.0.28) +307 more potentially affected by CVE-2020-1963 via org.apache.ignite:ignite-core (>=1.0.0-RC1 <=2.8.0)

org.apache.ignite:ignite-core MAVEN version =1.0.0-RC1, =0.0.22, =0.0.10, =v1.0.0, =1.4.0, =7.6.1, =8.11.0, =8.11.0, =8.0.0, =1.0.0, =3.0.0-beta1, =1.0.0.RELEASE, =0.1.2, =0.14.0-RC1 and more Source cves: CVE-2020-1963 Source advisory: OSV:GHSA-5WM5-8Q42-RHXG...

io.micronaut.configuration:micronaut-netflix-ribbon (=1.1.0), io.micronaut.configuration:micronaut-security-oauth2 (>=1.3.0 <=1.3.1) +3 more potentially affected by CVE-2020-7611 via io.micronaut:micronaut-http-client (>=1.3.0 <=1.3.1)

io.micronaut:micronaut-http-client MAVEN version =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.1 Source cves: CVE-2020-7611 Source advisory: SNYK:JAVA-IOMICRONAUT-561342...

1filecompiler (=0.0.2), @adrian.u/adritoolbox (>=1.0.0 <=1.1.0) +801 more potentially affected by CVE-2020-8147 +1 more via utils-extend (=1.0.8)

utils-extend NPM version =1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on utils-extend and may be impacted: - 1filecompiler =0.0.2 - @adrian.u/adritoolbox =1.0.0, =0.1.1, =0.1.0, =0.1.0, =1.0.2, =0.1.0, =0.0.1, =0.37.8, =1.0.1, =0.1.0, =1.0.2,...

NeteaseCloudMusicRustApi (=0.1.1), RustMusic (=0.1.0) +171 more potentially affected by CVE-2020-35899 via actix-service (>=0.1.6 <=0.4.2)

actix-service CARGO version =0.1.6, =0.8.0, =0.1.8, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves: CVE-2020-35899 Source advisory: OSV:RUSTSEC-2020-0046...

04_nodeblog (=1.0.0), 10tcl (>=0.0.1 <=0.0.10) +3902 more potentially affected by unknown CVE via constantinople (>=1.0.2 <=3.0.2)

constantinople NPM version =1.0.2, =0.0.1, =1.0.1, =0.1.1, =0.0.1, =0.0.7, =1.0.23, =1.0.0, =1.0.0, =1.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-4VMM-MHCQ-4X9J...

eskapade-spark (>=0.8.0 <=0.8.2), pytispark (>=1.0.0rc2 <=1.0.1) +1 more potentially affected by CVE-2018-11760 via pyspark (>=2.1.2 <=2.2.0.post0)

pyspark PYPI version =2.1.2, =0.8.0, =1.0.0rc2, =1.0.1 - sourced-ml =0.4.5 Source cves: CVE-2018-11760 Source advisory: OSV:PYSEC-2019-169...

@1337lawyers/design (>=0.1.0 <=0.1.38), @9188/w-cli (>=1.0.0 <=1.0.4) +50 more potentially affected by CVE-2018-6342 via react-dev-utils (>=5.0.0 <=5.0.1)

react-dev-utils NPM version =5.0.0, =0.1.0, =1.0.0, =0.4.1, =0.1.0-latest.1a450bb3, =1.0.5, =1.0.0-beta.28, =1.0.1, =1.0.0, =1.0.0, =0.26.4, =0.0.0-legacy, =3.10.0-beta.0, =0.1.0-alpha.0, =2.1.16, =2.3.5 - aqxy-common-ui =0.0.1 and more Source cves: CVE-2018-6342 Source advisory:...

com.microsoft.azure:azure-active-directory-b2c-spring-boot-starter (>=2.1.4.M1 <=2.1.6.M2), com.sap.cloud.security.xsuaa:spring-xsuaa (>=1.1.0 <=2.1.0) +4 more potentially affected by CVE-2018-15801 via org.springframework.security:spring-security-oauth2-jose (>=5.1.10.RELEASE <=5.1.1.RELEASE)

org.springframework.security:spring-security-oauth2-jose MAVEN version =5.1.10.RELEASE, =2.1.4.M1, =1.1.0, =1.2.0, =1.2.0, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.18.RELEASE Source cves: CVE-2018-15801 Source advisory: OSV:GHSA-27XW-P8V6-9JJR...

08cms (=1.0.0), 10secondsofcode-custom (=1.0.0) +3091 more potentially affected by CVE-2017-16017 via sanitize-html (>=0.1.4 <=1.27.5)

sanitize-html NPM version =0.1.4, =1.0.0, =1.0.0, =1.0.0, =0.6.0, =0.1.0, =0.1.0, =11.1.0, =1.0.0, =1.0.1, =0.2.0, =0.1.0, =0.19.1-rc.2, =0.19.1-rc.4 and more Source cves: CVE-2017-16017 Source advisory: OSV:GHSA-WG96-3933-J2W5...

ai.agnos:reactive-sparql_2.12 (>=0.3.0 <=0.3.1), be.cetic:rts-gen_2.12 (>=0.1.3 <=0.1.13) +382 more potentially affected by CVE-2018-18853 via io.spray:spray-json_2.12 (>=1.3.2 <=1.3.4)

io.spray:spray-json2.12 MAVEN version =1.3.2, =0.3.0, =0.1.3, =0.1.14, =0.11.1, =0.15.2, =0.2.0, =0.0.82.12, =1.23.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0-RC8 - com.chudsaviet.gradle.avrohugger:com.chudsaviet.gradle.avrohugger.gradle.plugin =0.2.4 - com.cra.figaro:figaro2.12 =5.0.0.0 and more Source...

org.dspace.modules:xmlui (>=3.0 <=3.5) potentially affected by CVE-2016-10726 via org.dspace:dspace-xmlui (>=3.0 <=3.5)

org.dspace:dspace-xmlui MAVEN version =3.0, =3.0, =3.5 Source cves: CVE-2016-10726 Source advisory: OSV:GHSA-4M9R-5GQP-7J82...

ae.teletronics.nlp:entityextraction (>=1.3 <=1.4), ai.h2o:h2o-app (>=0.1.22 <=0.1.25) +1040 more potentially affected by CVE-2016-1000352 via org.bouncycastle:bcprov-jdk15 (>=1.38 <=1.46)

org.bouncycastle:bcprov-jdk15 MAVEN version =1.38, =1.3, =0.1.22, =0.1.22, =1.0.0, =2.1.0, =1.0.1, =4.2.0, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.0.3, =1.3.3 and more Source cves: CVE-2016-1000352 Source advisory: OSV:GHSA-W285-WF9Q-5W69...

br.net.woodstock.rockframework:rockframework-core (>=1.2.1 <=1.2.2), com.alanpoi:alanpoi-all (>=1.3.5 <=3.0.0) +64 more potentially affected by CVE-2016-1000342 via org.bouncycastle:bcprov-jdk14 (>=1.38 <=1.55)

org.bouncycastle:bcprov-jdk14 MAVEN version =1.38, =1.2.1, =1.3.5, =1.3.5, =2.0, =1.0, =1.6.1.P24, =1.7, =0.0.1, =1.0, =1.1 - com.github.lkkushan101.RestAssuredPDFReport:com.github.lkkushan101.RestAssuredPDFReport =1.00 - com.github.lkkushan101.appiumlocator:com.github.lkkushan101.appiumlocator...

ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0 <=1.1.0), au.com.turingg:turingg-files (=0.0.1) +1122 more potentially affected by CVE-2018-11796 via org.apache.tika:tika-core (>=0.10 <=1.19)

org.apache.tika:tika-core MAVEN version =0.10, =1.0.0, =4.2.0, =1.0.68, =3.6.1, =3.11.0, =1.0.0, =4.6.0, =5.6.100, =2.0.6, =1.0.10, =1.0.12, =1.0.32 and more Source cves: CVE-2018-11796 Source advisory: OSV:GHSA-H8Q5-G2CJ-QR5H...

sqlite (>=0.19.7 <=0.21.1), sqlite3-sys (>=0.6.7 <=0.9.2) +3 more potentially affected by unknown CVE via temporary (=0.5.1)

temporary CARGO version =0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on temporary and may be impacted: - sqlite =0.19.7, =0.6.7, =0.11.0, =0.2.6, =0.2.7 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2018-0022...

metadoc (>=0.9.1 <=0.10.5), sphinxmark (>=0.1.15 <=0.1.16) potentially affected by CVE-2016-9964 via bottle (=0.12.10)

bottle PYPI version =0.12.10 is affected by a known vulnerability. The following packages have a transitive dependency on bottle and may be impacted: - metadoc =0.9.1, =0.1.15, =0.1.16 Source cves: CVE-2016-9964 Source advisory: OSV:PYSEC-2016-24...

h2o-notebook (>=0.3.0 <=0.4.1) potentially affected by CVE-2026-44180 via jupyter-enterprise-gateway (=3.2.2)

jupyter-enterprise-gateway PYPI version =3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-enterprise-gateway and may be impacted: - h2o-notebook =0.3.0, =0.4.1 Source cves: CVE-2026-44180 Source advisory: OSV:PYSEC-2026-363...

ayy (>=0.1.6 <=0.1.8), camel-database-agent (>=0.1.0 <=0.2.0) +21 more potentially affected by CVE-2026-53753 via crawl4ai (>=0.3.5 <=0.8.5)

crawl4ai PYPI version =0.3.5, =0.1.6, =0.1.0, =0.2.0, =0.1.0, =0.0.38, =0.5.0, =0.1.0, =0.1.6 and more Source cves: CVE-2026-53753 Source advisory: OSV:PYSEC-2026-319...

3-04-2025-ttm (=0.1.0), a-mailx (=0.1.0) +4989 more potentially affected by CVE-2026-44727 via jupyter-server (>=0.0.5 <=2.1.0)

jupyter-server PYPI version =0.0.5, =0.1.0, =1.0.3, =0.1.8, =0.1.0, =1.0.0, =0.0.1, =0.1.3, =0.1.3, =0.1.4 and more Source cves: CVE-2026-44727 Source advisory: OSV:PYSEC-2026-366...

@conglomerate/weaver (>=2.1.1 <=2.6.1), @derivative/derive (>=0.1.0 <=0.1.1) +11 more potentially affected by CVE-2026-55180 via pnpm (>=0.21.0 <=10.33.2)

pnpm NPM version =0.21.0, =2.1.1, =0.1.0, =0.1.0, =3.7.16, =2.3.0, =0.0.2, =0.1.0, =0.2.7, =1.0.4, =1.0.7 Source cves: CVE-2026-55180 Source advisory: OSV:GHSA-3QHV-2RGH-X77R...

@alok5953/videoextract (>=1.0.0 <=1.0.7), @anichart/remotion (>=0.0.6 <=0.2.1) +101 more potentially affected by CVE-2026-30120 via remotion (>=1.4.0-alpha.a42341a0 <=4.0.41)

remotion NPM version =1.4.0-alpha.a42341a0, =1.0.0, =0.0.6, =1.1.0, =1.1.0, =1.1.0, =0.1.16, =6.0.1, =0.1.38, =1.5.2, =0.1.91, =0.1.0, =5.2.0, =5.5.8 and more Source cves: CVE-2026-30120 Source advisory: OSV:GHSA-2JQP-F4GR-44FR...

@hulumi/platform-patterns (>=0.0.0-bootstrap.0 <=1.3.2) potentially affected by CVE-2026-48037 via @hulumi/baseline (>=1.3.1 <=1.3.2)

@hulumi/baseline NPM version =1.3.1, =0.0.0-bootstrap.0, =1.3.2 Source cves: CVE-2026-48037 Source advisory: OSV:GHSA-CJ8G-PRCM-MFG5...

@hulumi/platform-patterns (>=0.0.0-bootstrap.0 <=1.3.2) potentially affected by CVE-2026-48035 via @hulumi/baseline (>=1.3.1 <=1.3.2)

@hulumi/baseline NPM version =1.3.1, =0.0.0-bootstrap.0, =1.3.2 Source cves: CVE-2026-48035 Source advisory: OSV:GHSA-2MXR-P26X-MJ73...

227checkergenerator (>=1.0.0 <=1.0.1), 5mghost-rover (>=0.0.1 <=0.0.3) +1701 more potentially affected by CVE-2026-34993 via aiohttp (>=3.0.0b0 <=3.13.5)

aiohttp PYPI version =3.0.0b0, =1.0.0, =0.0.1, =0.1.1, =0.1.0b0, =1.1.0, =1.0.1, =0.6.0, =0.0.0, =0.0.2, =0.0.3 and more Source cves: CVE-2026-34993 Source advisory: SNYK:PYTHON-AIOHTTP-17146576...

ai.h2o:sparkling-water-core_2.11 (>=3.46.0.1-1-2.3 <=3.46.0.6-1-2.4), ai.h2o:sparkling-water-core_2.12 (>=3.46.0.1-1-3.0 <=3.46.0.6-1-3.5) +762 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (>=2.2.0 <=2.2.7)

org.apache.mina:mina-core MAVEN version =2.2.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =1.5.4.RELEASE, =0.0.2, =3.0.0, =1.0.9, =1.6.9, =1.2.5, =1.1.7, =1.2.8 and more Source cves: CVE-2026-47065 Sourc...

@accounter/client (>=0.0.3 <=0.0.11-alpha-20260404002702-9340365def1af08a5cdbbf734a87d1d4839bdaff), @asamanvay/auth-service (>=0.0.2 <=0.0.4) +122 more potentially affected by CVE-2026-34077 via react-router (>=7.0.0 <=7.14.0-pre.0)

react-router NPM version =7.0.0, =0.0.3, =0.0.2, =3.5.2, =1.1.0, =1.0.1-MON-198808-web-js-deps-batch-1.0, =0.0.1, =3.4.9, =0.1.9, =1.27.1, =1.27.1, =0.3.1, =7.13.1-depup.0, =7.13.2-depup.0 and more Source cves: CVE-2026-34077 Source advisory: SNYK:JS-REACTROUTER-17138883...

edf-centrifuge (=1.0.0) potentially affected by CVE-2026-35212 via pycti (=6.9.29)

pycti PYPI version =6.9.29 is affected by a known vulnerability. The following packages have a transitive dependency on pycti and may be impacted: - edf-centrifuge =1.0.0 Source cves: CVE-2026-35212 Source advisory: OSV:PYSEC-2026-203...

com.espertech:esperio-springjms (=9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0 <=6.2.5) +5 more potentially affected by CVE-2026-42588 via org.apache.activemq:activemq-all (>=6.0.0 <=6.2.5)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.5 Source cves: CVE-2026-42588 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-17151887...

360solutions-bc-mcp (>=0.5.3 <=0.5.6), 3di-cmd-client (>=0.0.1a0 <=0.0.3) +749 more potentially affected by CVE-2026-48525 via pyjwt (>=2.0.0 <=2.12.1)

pyjwt PYPI version =2.0.0, =0.5.3, =0.0.1a0, =1.1.1, =0.1.0, =0.1.1, =0.1.31, =0.1.0, =1.5.0, =0.1.0, =0.2.9, =0.5.0, =1.89.5, =1.420.4 and more Source cves: CVE-2026-48525 Source advisory: SNYK:PYTHON-PYJWT-17053409...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0 <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8 <=3.1.14-jdk17) +219 more potentially affected by CVE-2026-9689 via org.keycloak:keycloak-services (>=10.0.0 <=9.0.3)

org.keycloak:keycloak-services MAVEN version =10.0.0, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =1.4.11 - com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak =24.3.0.0 -...

org.yamcs:distribution (>=5.0.0 <=5.12.6), org.yamcs:packet-viewer (>=5.0.0 <=5.12.6) +9 more potentially affected by CVE-2026-44595 via org.yamcs:yamcs-core (>=5.0.0 <=5.12.6)

org.yamcs:yamcs-core MAVEN version =5.0.0, =5.0.0, =5.0.0, =5.10.0, =5.10.0, =0.1.0, =0.1, =1.0.0, =5.0.0, =5.0.0, =0.1.0, =0.8.0 Source cves: CVE-2026-44595 Source advisory: SNYK:JAVA-ORGYAMCS-17229842...

org.glassfish.main.admingui:admingui (>=7.0.0 <=9.0.0-M1), org.glassfish.main.admingui:console-cluster-plugin (>=7.0.0 <=9.0.0-M1) +19 more potentially affected by CVE-2026-2587 via org.glassfish.jsftemplating:jsftemplating (>=4.0.0 <=4.1.0)

org.glassfish.jsftemplating:jsftemplating MAVEN version =4.0.0, =7.0.0, =7.0.0, =7.0.16, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =9.0.0-M1 and more Source cves: CVE-2026-2587 Source advisory: SNYK:JAVA-ORGGLASSFISHJSFTEMPLATING-167906...

fhrons-mobile (>=1.1.2-5.2 <=1.2.4-beta.5), fhrons-mobile-next (>=2.0.1 <=2.0.4) +1 more potentially affected by unknown CVE via @antv/f6 (=0.0.19)

@antv/f6 NPM version =0.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f6 and may be impacted: - fhrons-mobile =1.1.2-5.2, =2.0.1, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6-16754813...

@antv/g-mobile-webgl (>=0.0.2 <=0.0.4-alpha.16), @antv/g-plugin-3d (>=1.0.0-alpha.1 <=1.0.24-alpha.16) +1 more potentially affected by unknown CVE via @antv/g-plugin-webgl-renderer (=1.0.26)

@antv/g-plugin-webgl-renderer NPM version =1.0.26 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/g-plugin-webgl-renderer and may be impacted: - @antv/g-mobile-webgl =0.0.2, =1.0.0-alpha.1, =1.0.0-alpha.0, =1.0.26-alpha.16 Source cves: unknown CV...

@antv/xflow (>=2.0.1 <=2.2.4), @antv/xflow-diff (=1.0.0) +64 more potentially affected by unknown CVE via @antv/x6-plugin-transform (>=2.1.7 <=2.1.8)

@antv/x6-plugin-transform NPM version =2.1.7, =2.0.1, =0.0.1, =0.0.2, =0.0.4, =0.0.3, =2.0.4, =0.0.27, =0.0.3, =0.0.2, =0.0.64 - @rxdrag/uml-editor =0.6.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVX6PLUGINTRANSFORM-16754401...

@bassist/eslint-config (>=0.3.0 <=0.5.0), @bassist/oxc-integration (>=0.1.0 <=0.2.0) +7 more potentially affected by unknown CVE via @lint-md/core (>=2.0.0-beta.14 <=2.0.0)

@lint-md/core NPM version =2.0.0-beta.14, =0.3.0, =0.1.0, =2.0.0, =4.1.0, =1.1.0, =1.19.7, =1.1.0, =1.0.0, =1.3.4, =1.3.5 Source cves: unknown CVE Source advisory: SNYK:JS-LINTMDCORE-16754836...

@antv/gpt-vis (=0.5.0-beta.0), @antv/gpt-vis-ssr (>=0.1.0 <=0.3.8) +7 more potentially affected by unknown CVE via @antv/g2-ssr (>=0.0.8 <=0.2.0)

@antv/g2-ssr NPM version =0.0.8, =0.1.0, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVG2SSR-16754434...

@antv/chart-advisor (>=1.1.4 <=1.1.7), @opd/ava (=1.0.0) +1 more potentially affected by unknown CVE via @antv/dw-util (=1.1.4)

@antv/dw-util NPM version =1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/dw-util and may be impacted: - @antv/chart-advisor =1.1.4, =1.0.0, =1.0.10 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVDWUTIL-16755068...

@0xsequence/checkout (>=0.0.0-20250314205219 <=5.2.4), @0xsequence/kit-checkout (>=0.0.0-20250305153405 <=4.6.6-beta.0) +190 more potentially affected by unknown CVE via timeago-react (>=3.0.2 <=3.0.7)

timeago-react NPM version =3.0.2, =0.0.0-20250314205219, =0.0.0-20250305153405, =1.0.0, =1.0.0, =0.5.4, =1.0.1, =2.0.10, =0.25.0, =0.23.0, =0.0.1, =1.0.7, =1.1.6 and more Source cves: unknown CVE Source advisory: SNYK:JS-TIMEAGOREACT-16754867...

lightrft (=0.1.0), rl-square (=0.0.1.post1) potentially affected by CVE-2026-7304 via sglang (>=0.4.5 <=0.4.6.post5)

sglang PYPI version =0.4.5, =0.4.6.post5 is affected by a known vulnerability. The following packages have a transitive dependency on sglang and may be impacted: - lightrft =0.1.0 - rl-square =0.0.1.post1 Source cves: CVE-2026-7304 Source advisory: OSV:GHSA-36M8-W8QF-G76P...

cn.ibizlab.plugin:ibiz-dataflow-flink (>=8.1.0.371 <=8.1.0.567.22), cn.sliew:flinkful-cli-descriptor-examples (>=1.0.2 <=1.0.7) +348 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-api-java (>=1.15.0 <=1.20.3)

org.apache.flink:flink-table-api-java MAVEN version =1.15.0, =8.1.0.371, =1.0.2, =1.0.2, =1.0.2, =1.0.2, =1.0.2, =1.0.3, =1.0.0, =1.0.2, =1.0.2, =0.5.0, =0.5.0, =1.4.0, =1.5.6.2 and more Source cves: CVE-2026-35194 Source advisory: OSV:GHSA-2F54-V4HM-FX73...

budibase (>=0.0.3 <=0.0.31) potentially affected by CVE-2026-45715 via @budibase/server (>=0.0.1 <=0.0.9)

@budibase/server NPM version =0.0.1, =0.0.3, =0.0.31 Source cves: CVE-2026-45715 Source advisory: OSV:GHSA-FGQV-JH4G-PVG2...

apheris-auth (=0.23.0), apheris-cli (>=0.51.0 <=0.52.0) +1 more potentially affected by CVE-2026-44681 via authlib (=1.7.0)

authlib PYPI version =1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - apheris-auth =0.23.0 - apheris-cli =0.51.0, =1.3.0, =1.3.0b4 Source cves: CVE-2026-44681 Source advisory: OSV:GHSA-R95X-QFJJ-FJJ2...

@0xchain/telemetry (>=1.1.0-beta.8 <=1.1.0-beta.18), @20206205tech/nestjs-common (>=0.8.0 <=0.11.3) +958 more potentially affected by CVE-2026-44293 via protobufjs (>=8.0.0 <=8.0.1)

protobufjs NPM version =8.0.0, =1.1.0-beta.8, =0.8.0, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.8.0 and more Source cves: CVE-2026-44293 Source advisory: OSV:GHSA-66FF-XGX4-VCHM...

@forwardimpact/libcodegen (>=0.1.47 <=0.1.52) potentially affected by CVE-2026-42290 via protobufjs-cli (=2.0.1)

protobufjs-cli NPM version =2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobufjs-cli and may be impacted: - @forwardimpact/libcodegen =0.1.47, =0.1.52 Source cves: CVE-2026-42290 Source advisory: OSV:GHSA-F84P-CVGM-XGJJ...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0 <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0 <=0.2.0) +289 more potentially affected by CVE-2026-41713 via org.springframework.ai:spring-ai-client-chat (>=1.1.0-M1 <=1.1.5)

org.springframework.ai:spring-ai-client-chat MAVEN version =1.1.0-M1, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.6.0, =1.1.0, =1.1.0, =1.1.0, =1.1.4 and more Source cves: CVE-2026-41713 Source advisory: OSV:GHSA-5852-PHMH-8FHR...