01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +18979 more potentially affected by CVE-2026-12590 via body-parser (>=1.0.0, <=1.20.5)

body-parser NPM version =1.0.0, =1.0.0, =0.2.0, =1.0.2, =2.0.0, =0.2.0, =0.0.978, =0.2.0, =0.0.1, =0.0.28, =0.0.36 and more Source cves: CVE-2026-12590 Source advisory: SNYK:JS-BODYPARSER-17906397...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @appium/base-driver (>=10.0.0-rc.2, <=10.7.1) +179 more potentially affected by CVE-2026-12590 via body-parser (>=2.0.0-beta.1, <=2.2.2)

body-parser NPM version =2.0.0-beta.1, =0.3.1, =10.0.0-rc.2, =3.2.0, =4.2.0, =1.0.0, =2.0.32, =1.4.0, =1.1.1, =1.0.15, =1.0.15, =1.0.1-beta.1, =9.1.1-ruixiang.1, =9.0.0, =3.0.10, =3.8.8, =3.9.1 and more Source cves: CVE-2026-12590 Source advisory: SNYK:JS-BODYPARSER-17906397...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +176 more potentially affected by CVE-2026-55575 via liquidjs (>=10.2.0, <=10.27.0)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.4.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.8.0, =0.31.16 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-55575 Source advisory:...

@aoagents/ao (>=0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, <=0.10.1-nightly-249c67046d14809943d228b01eefedb10821e5dc), @aoagents/ao-cli (>=0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, <=0.10.1-nightly-249c67046d14809943d228b01eefedb10821e5dc) +81 more potentially affected by CVE-2026-59807 via @composio/core (>=0.1.0-rc.3, <=0.13.1)

@composio/core NPM version =0.1.0-rc.3, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.0.2, =1.0.0, =0.1.0-rc.3, =4.4.0, =3.7.18, =3.7.18, =3.7.18, =3.7.18, =3.7.18,...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +912 more potentially affected by CVE-2026-59875 via tar (>=7.0.0, <=7.5.16)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59875 Source advisory: SNYK:JS-TAR-17909225...

@a1st/aix (>=0.0.3, <=0.6.0), @a1st/aix-core (>=0.2.0, <=0.6.0) +20 more potentially affected by CVE-2026-59731 via astro (>=6.0.0-beta.1, <=6.4.6)

astro NPM version =6.0.0-beta.1, =0.0.3, =0.2.0, =1.11.1, =2.7.0, =0.3.0, =0.22.0, =1.4.1, =0.19.0, =0.19.0, =1.10.0, =1.12.1 - astro-crush 1.0.0 and more Source cves: CVE-2026-59731 Source advisory: SNYK:JS-ASTRO-17901336...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +916 more potentially affected by CVE-2026-59874 via tar (>=7.0.0, <=7.5.17)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59874 Source advisory: SNYK:JS-TAR-17909068...

0.edsql (>=1.0.49, <=1.0.50), 10secondsofcode-custom (1.0.0) +2058 more potentially affected by CVE-2026-59725 via engine.io (>=4.1.1, <=6.6.6)

engine.io NPM version =4.1.1, =1.0.49, =1.0.0, =0.0.28, =1.0.1, =0.8.2, =1.0.0, =0.1.13, =0.0.4, =1.2.1, =15.0.0, =1.0.1, =1.0.2 - @aaronconway7/create-gatsby-app 1.0.0 - @accio-cms/gatsby-starter-accio 0.0.1 and more Source cves: CVE-2026-59725 Source advisory: SNYK:JS-ENGINEIO-17900543...

@briefhq/cli (>=0.1.6, <=0.1.22), @cobuild/review-gpt (>=0.5.10, <=0.5.145) +5 more potentially affected by CVE-2026-59703 via repomix (>=1.1.0, <=1.16.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =0.1.0-next.1, =1.0.0, =0.1.0, =0.63.0, =0.63.3 Source cves: CVE-2026-59703 Source advisory: SNYK:JS-REPOMIX-17905425...

ratex-layout (0.0.3) potentially affected by CVE-2026-53530 via ratex-parser (0.0.3)

ratex-parser CARGO version 0.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ratex-parser and may be impacted: - ratex-layout 0.0.3 Source cves: CVE-2026-53530 Source advisory: OSV:GHSA-4HGP-59H5-GVRJ...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +199 more potentially affected by CVE-2026-53518 via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-53518 Source advisory: OSV:GHSA-7W99-5WM4-3G79...

@inkeep/agents-api (>=0.73.0, <=0.80.6), @inkeep/agents-cli (>=0.73.0, <=0.80.6) +5 more potentially affected by CVE-2026-53518 via @better-auth/oauth-provider (1.6.9)

@better-auth/oauth-provider NPM version 1.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on @better-auth/oauth-provider and may be impacted: - @inkeep/agents-api =0.73.0, =0.73.0, =0.73.1, =0.73.0, =0.73.1, =0.73.1, =0.73.1, =0.80.6 Source cves:...

@inkeep/agents-api (>=0.73.0, <=0.80.6), @inkeep/agents-cli (>=0.73.0, <=0.80.6) +5 more potentially affected by CVE-2026-53518 via @better-auth/oauth-provider (1.6.9)

@better-auth/oauth-provider NPM version 1.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on @better-auth/oauth-provider and may be impacted: - @inkeep/agents-api =0.73.0, =0.73.0, =0.73.1, =0.73.0, =0.73.1, =0.73.1, =0.73.1, =0.80.6 Source cves:...

@inkeep/agents-api (>=0.73.0, <=0.80.6), @inkeep/agents-cli (>=0.73.0, <=0.80.6) +5 more potentially affected by CVE-2026-53517 via @better-auth/oauth-provider (1.6.9)

@better-auth/oauth-provider NPM version 1.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on @better-auth/oauth-provider and may be impacted: - @inkeep/agents-api =0.73.0, =0.73.0, =0.73.1, =0.73.0, =0.73.1, =0.73.1, =0.73.1, =0.80.6 Source cves:...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +199 more potentially affected by unknown CVE via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: unknown CVE Source advisory: SNYK:JS-BETTERAUTH-17889826...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +217 more potentially affected by unknown CVE via better-auth (>=1.0.0, <=1.6.12)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: unknown CVE Source advisory: SNYK:JS-BETTERAUTH-17889822...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +199 more potentially affected by CVE-2026-53516 via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-53516 Source advisory: SNYK:JS-BETTERAUTH-17889818...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +188 more potentially affected by CVE-2026-53516 via @better-auth/core (>=1.3.18, <=1.6.10)

@better-auth/core NPM version =1.3.18, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.3.18, =1.5.0-beta.13 and more Source cves: CVE-2026-53516 Source advisory: SNYK:JS-BETTERAUTHCORE-17889819...

@absinthe/graphql-playground (>=1.3.1, <=1.3.5), @absinthe/socket (>=0.1.0, <=0.2.0) +52 more potentially affected by CVE-2026-56812 via phoenix (>=1.3.0, <=1.5.12)

phoenix NPM version =1.3.0, =1.3.1, =0.1.0, =0.1.2, =0.1.0, =0.1.2, =1.7.5, =1.5.1, =1.7.5, =1.8.1, =1.0.0, =1.5.6, =1.8.1, =1.8.1, =1.7.26, =1.7.26, =1.16.6-beta-eaa4d39d and more Source cves: CVE-2026-56812 Source advisory: SNYK:JS-PHOENIX-17889828...

@edgebrix-sdk/react (>=0.0.58, <=0.0.74), @kimia_software/tellair-wc (0.0.0) +16 more potentially affected by CVE-2026-56812 via phoenix (>=1.6.2, <=1.6.16)

phoenix NPM version =1.6.2, =0.0.58, =0.8.10, =0.1.8, =0.1.5, =0.1.0-rc0, =0.8.1, =0.0.1, =0.0.1, =0.0.0-PR-1--182e1d3, =19.0.0-beta.1, =1.0.23, =0.3.0, =0.1.1, =0.1.6 and more Source cves: CVE-2026-56812 Source advisory: SNYK:JS-PHOENIX-17889828...

20mk-utils (>=1.0.0, <=1.0.3), 2d-spirograph (>=1.0.2, <=1.0.4) +2124 more potentially affected by CVE-2026-59710 via showdown (>=0.0.1, <=2.1.0)

showdown NPM version =0.0.1, =1.0.0, =1.0.2, =2.0.4, =1.0.6, =0.1.4, =0.1.4, =0.1.4, =13.351.0, =13.351.0, =7.10.0, =7.10.0, =0.0.3, =0.5.1 - @adalink/spark-chat 1.0.0 and more Source cves: CVE-2026-59710 Source advisory: SNYK:JS-SHOWDOWN-17874450...

ledger-zcash (>=0.3.0, <=0.5.0), zcash-hsmbuilder (>=0.2.0, <=0.3.0) +3 more potentially affected by CVE-2026-54496 via zcash_primitives (0.5.0)

zcashprimitives CARGO version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on zcashprimitives and may be impacted: - ledger-zcash =0.3.0, =0.2.0, =0.3.0 - zcashclientbackend 0.5.0 - zcashclientsqlite 0.3.0 - zcashproofs 0.5.0 Source cves:...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +28851 more potentially affected by CVE-2026-53486 via decompress (>=0.1.6, <=4.2.1)

decompress NPM version =0.1.6, =1.0.0, =0.0.1, =0.0.4 - 1095h-cli 1.0.1 - 10secondsofcode-custom 1.0.0 and more Source cves: CVE-2026-53486 Source advisory: SNYK:JS-DECOMPRESS-17874437...

bdy (>=1.18.27-dev, <=1.22.61-stage) potentially affected by CVE-2026-53486 via @xhmikosr/decompress (11.1.1)

@xhmikosr/decompress NPM version 11.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @xhmikosr/decompress and may be impacted: - bdy =1.18.27-dev, =1.22.61-stage Source cves: CVE-2026-53486 Source advisory: OSV:GHSA-MP2F-45PM-3CG9...

coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35358 via uu_cp (>=0.0.14, <=0.0.16)

uucp CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35358 Source advisory: OSV:GHSA-8VRF-R662-2W2V...

coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35343 via uu_cut (>=0.0.14, <=0.0.16)

uucut CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35343 Source advisory: OSV:GHSA-WV33-5PXH-R7J7...

cookie-parser-ease (1.0.7) potentially affected by unknown CVE via cookie-ease (0.0.1-security)

cookie-ease NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on cookie-ease and may be impacted: - cookie-parser-ease 1.0.7 Source cves: unknown CVE Source advisory: SNYK:JS-COOKIEEASE-17824388...

-react-file-list-components (1.1.1), -tompan-reacttemplate (>=1.0.1, <=1.1.0) +41035 more potentially affected by CVE-2026-14802 via react-dev-utils (>=0.1.1, <=12.1.0-next.26)

react-dev-utils NPM version =0.1.1, =1.0.1, =0.1.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 - 0scarclassi 1.0.1 and more Source cves: CVE-2026-148...

@codeanywhere/filesystem (>=1.13.0, <=1.13.2), @codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4) +169 more potentially affected by CVE-2026-10054 via @theia/core (>=1.0.0, <=1.72.3)

@theia/core NPM version =1.0.0, =1.13.0, =1.11.0, =0.1.7, =0.0.1-1646139429, =0.0.1-1585667205, =1.0.0-theia1.27.0, =0.8.0-next.6917503, =0.0.1-next.20220331.125641, =0.0.5, =0.1.0-alpha.3ddb00f8, =0.2.0-next.25250370, =0.2.0-next.ffc3e7a2 and more Source cves: CVE-2026-10054 Source advisory:...

dicom-transfer-syntax-registry (>=0.8.2, <=0.9.1), dset (>=0.1.0, <=0.1.2) +2 more potentially affected by unknown CVE via jxl-oxide (>=0.4.0, <=0.11.4)

jxl-oxide CARGO version =0.4.0, =0.8.2, =0.1.0, =0.1.1, =0.4.0, =0.5.0-rc0 Source cves: unknown CVE Source advisory: OSV:GHSA-66M8-C62J-H6V5...

@falcondev-oss/nuxt-layers-base (>=0.1.0, <=0.25.0), @iqual/nuxt-icms (>=1.6.0-rc.1, <=1.6.1) +25 more potentially affected by unknown CVE via @nuxt/ui (>=4.0.0, <=4.8.0)

@nuxt/ui NPM version =4.0.0, =0.1.0, =1.6.0-rc.1, =1.1.6, =0.0.19, =0.5.0, =0.0.7, =0.0.0-test-ld-20260520212549, =0.0.0-test-ld-20260520212549, =0.9.0, =0.0.0-test-ld-20260520212549, =0.0.0-test-ld-20260520212549, =0.4.0, =0.4.0, =1.1.0, =1.0.1, =1.1.4 and more Source cves: unknown CVE Source...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +342 more potentially affected by CVE-2026-52746 via jsonata (>=1.0.10, <=1.8.8)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-52746 Source advisory: OSV:GHSA-86VW-MFPG-WWV9...

@grackle-ai/cli (>=0.72.3, <=0.132.1), @grackle-ai/core (>=0.75.4, <=0.132.1) +7 more potentially affected by unknown CVE via @grackle-ai/auth (>=0.72.3, <=0.132.1)

@grackle-ai/auth NPM version =0.72.3, =0.72.3, =0.75.4, =0.72.3, =0.96.3, =0.99.0, =0.97.0, =0.98.0, =0.72.3, =0.75.1, =0.132.1 Source cves: unknown CVE Source advisory: OSV:GHSA-F9FF-5X35-7GFW...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.11) +22 more potentially affected by CVE-2026-53818 via openclaw (>=2026.3.22, <=2026.4.23)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.0.1, =0.3.0 and more Source cves: CVE-2026-53818 Source advisory: OSV:GHSA-RJ6P-XMXR-QJ4H...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.10) +21 more potentially affected by CVE-2026-53830 via openclaw (>=2026.3.22, <=2026.4.21)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-53830 Source advisory: OSV:GHSA-275C-XPVC-JGFW...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53837 via openclaw (>=2026.3.22, <=2026.5.2)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53837 Source advisory: OSV:GHSA-GP79-M99V-GJMH...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53822 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53822 Source advisory: OSV:GHSA-2J8V-HWGC-X698...

@myrtex-org/ui (>=1.0.1, <=1.2.10), @rosgrant-org/ui (>=1.0.1, <=1.0.4) +3 more potentially affected by CVE-2026-54756 via jodit (>=4.0.18, <=4.3.2)

jodit NPM version =4.0.18, =1.0.1, =1.0.1, =0.41.1, =2.0.0-alpha.2, =17.0.70, =17.2.9 Source cves: CVE-2026-54756 Source advisory: SNYK:JS-JODIT-17796054...

@36node/auth-sdk (>=1.1.1-pr-7-1d68cf28da, <=2.28.0), @7nohe/openapi-react-query-codegen (>=0.0.0-13d458778df8db161111e788ed4207a13a110724, <=2.1.0) +140 more potentially affected by CVE-2026-48819 via @hey-api/openapi-ts (>=0.43.0, <=0.96.1)

@hey-api/openapi-ts NPM version =0.43.0, =1.1.1-pr-7-1d68cf28da, =0.0.0-13d458778df8db161111e788ed4207a13a110724, =1.0.0, =0.7.1, =0.0.1, =1.0.0, =0.0.12, =0.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.0, =0.0.1-react-native, =0.0.763 and more Source cves: CVE-2026-48819 Source advisory:...

@briefhq/cli (>=0.1.6, <=0.1.11), @cobuild/review-gpt (>=0.5.10, <=0.5.96) +3 more potentially affected by CVE-2026-49987 via repomix (>=1.1.0, <=1.14.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =1.0.0, =0.63.0, =0.63.3 Source cves: CVE-2026-49987 Source advisory: OSV:GHSA-9MM9-RQHJ-J5MX...

@arenahito/droid-webscr (>=0.2.1, <=0.6.0), @cappa/cli (>=0.4.4, <=0.10.4) +2 more potentially affected by CVE-2026-14181 via @fastify/middie (>=9.1.0, <=9.3.2)

@fastify/middie NPM version =9.1.0, =0.2.1, =0.4.4, =0.2.8, =1.0.0-alpha.23, =1.0.0-alpha.28 Source cves: CVE-2026-14181 Source advisory: SNYK:JS-FASTIFYMIDDIE-17753355...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +28 more potentially affected by CVE-2026-13149 via brace-expansion (>=1.1.0, <=1.1.13)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.3, =0.1.0 and more Source cves: CVE-2026-13149 Source advisory: SNYK:JS-BRACEEXPANSION-17706650...

com.github.manosbatsis.kmm.converters:kmm-converters-elide (1.0.0-alpha.2), com.github.manosbatsis.kmm.converters:kmm-converters-elide-autoconfigure (1.0.0-alpha.2) +42 more potentially affected by CVE-2026-57954 via com.yahoo.elide:elide-core (>=1.0.0.1, <=7.2.0)

com.yahoo.elide:elide-core MAVEN version =1.0.0.1, =1.0.0-alpha.3, =1.0.0-alpha.3, =1.0.0-alpha.3, =0.0.1, =2.3.0, =5.0.0, =5.0.0, =1.0.0.8, =1.0.0.6, =5.1.2 and more Source cves: CVE-2026-57954 Source advisory: SNYK:JAVA-COMYAHOOELIDE-17755935...

ai.timefold.solver:timefold-solver-migration (>=0.8.38, <=1.5.0), ai.tripl:arc-deltalake-pipeline-plugin_2.11 (>=1.2.0, <=1.6.0) +2827 more potentially affected by CVE-2026-13503 via org.antlr:antlr4 (>=4.0, <=4.13.2)

org.antlr:antlr4 MAVEN version =4.0, =0.8.38, =1.2.0, =1.2.0, =1.0.0-alpha01, =1.0.0-alpha1, =1.1.0-alpha02, =1.0.0-alpha01, =3.2.0-alpha12, =3.2.0-alpha12, =2.4.0-alpha01, =2.4.0-alpha01, =2.0.0-rc02, =2.0.0-alpha1, =2.2.6 and more Source cves: CVE-2026-13503 Source advisory:...

co.cask.re:dre-core (>=1.0.1, <=1.1.2), co.cask.re:dre-plugins (>=1.0.1, <=1.1.2) +53 more potentially affected by CVE-2026-13502 via org.antlr:antlr4-maven-plugin (>=4.1, <=4.13.2)

org.antlr:antlr4-maven-plugin MAVEN version =4.1, =1.0.1, =1.0.1, =1.0, =0.1, =1.5.2, =1.4.8, =1.6.5 and more Source cves: CVE-2026-13502 Source advisory: SNYK:JAVA-ORGANTLR-17753946...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +12 more potentially affected by CVE-2026-59194 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-59194 Source advisory: SNYK:JS-PNPM-17661047...

kmcom-nuxt-layers (>=2.2.0, <=2.2.12) potentially affected by CVE-2026-59196 via pnpm (11.5.3)

pnpm NPM version 11.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pnpm and may be impacted: - kmcom-nuxt-layers =2.2.0, =2.2.12 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPM-17660537...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +12 more potentially affected by CVE-2026-59196 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPM-17660537...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +12 more potentially affected by CVE-2026-55699 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-55699 Source advisory: OSV:GHSA-4GXM-V5V7-FQC4...

@pnpm/building.after-install (>=1100.0.0, <=1101.0.18), @pnpm/building.commands (>=1100.0.0, <=1100.1.1) +11 more potentially affected by CVE-2026-55487 via @pnpm/building.policy (>=1100.0.0, <=1100.0.7)

@pnpm/building.policy NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =0.0.1, =0.0.21 Source cves: CVE-2026-55487 Source advisory: SNYK:JS-PNPMBUILDINGPOLICY-17661052...