@auriclabs/sst-types (>=0.0.1, <=0.1.0), @ccci/micro-server (>=1.0.57, <=1.0.132) +15 more potentially affected by CVE-2026-24910 via bun (>=1.0.2, <=1.3.2)

bun NPM version =1.0.2, =0.0.1, =1.0.57, =0.1.0, =8.0.4, =1.0.0, =0.0.0, =1.2.27, =1.2.21, =0.0.2, =0.0.33, =0.1.3, =0.0.19-beta.11, =0.10.31, =0.15.2 and more Source cves: CVE-2026-24910 Source advisory: SNYK:JS-BUN-15123966...

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +311 more potentially affected by CVE-2025-59471 via next (>=15.6.0-canary.41, <=16.1.4)

next NPM version =15.6.0-canary.41, =0.1.0, =1.0.0, =0.3.128, =1.0.0-canary.3, =0.1.0, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.1.0, =0.1.0, =1.0.4186, =1.0.4319 and more Source cves: CVE-2025-59471 Source advisory: OSV:GHSA-9G9P-9GW9-JX7F...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +338 more potentially affected by CVE-2026-24473 via hono (>=4.0.0, <=4.11.6)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =1.8.0 and more Source cves: CVE-2026-24473 Source advisory: OSV:GHSA-W332-Q679-J88P...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +338 more potentially affected by CVE-2026-24473 via hono (>=4.0.0, <=4.11.6)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =1.8.0 and more Source cves: CVE-2026-24473 Source advisory: SNYK:JS-HONO-15123868...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +338 more potentially affected by CVE-2026-24472 via hono (>=4.0.0, <=4.11.6)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =1.8.0 and more Source cves: CVE-2026-24472 Source advisory: OSV:GHSA-6WQW-2P9W-4VW4...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +338 more potentially affected by CVE-2026-24398 via hono (>=4.0.0, <=4.11.6)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =1.8.0 and more Source cves: CVE-2026-24398 Source advisory: SNYK:JS-HONO-15123483...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +338 more potentially affected by CVE-2026-24398 via hono (>=4.0.0, <=4.11.6)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =1.8.0 and more Source cves: CVE-2026-24398 Source advisory: OSV:GHSA-R354-F388-2FHH...

com.foxinmy:easemob4j (>=1.1.0, <=1.1.3), com.foxinmy:umeng4j (>=1.1.0, <=1.1.3) +13 more potentially affected by CVE-2026-24819 via com.foxinmy:weixin4j-base (>=1.0, <=1.10.2)

com.foxinmy:weixin4j-base MAVEN version =1.0, =1.1.0, =1.1.0, =1.9.0, =1.4, =1.0, =1.9.0, =1.4, =1.0, =1.8.0, =1.0.9-release, =0.0.2, =0.0.3 - org.oxerr:spring-security-wechat-samples-helloworld 0.0.1 Source cves: CVE-2026-24819 Source advisory: SNYK:JAVA-COMFOXINMY-15128702...

@kcconfigs/commitlint (>=0.1.0-beta.2, <=0.2.0), @pnpm/cache.commands (>=1000.0.52, <=1000.0.54) +35 more potentially affected by CVE-2026-23888 via @pnpm/fetching.binary-fetcher (>=1005.0.0, <=1005.0.1)

@pnpm/fetching.binary-fetcher NPM version =1005.0.0, =0.1.0-beta.2, =1000.0.52, =1001.2.17, =1001.1.13, =1016.0.0, =1002.2.21, =1003.0.24, =1002.0.3, =1000.0.52, =1001.0.16, =1001.1.10, =1002.1.28, =1000.3.8, =1002.0.23, =1000.1.51, =1000.1.53 and more Source cves: CVE-2026-23888 Source advisory:...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +10 more potentially affected by CVE-2026-23889 via pnpm (>=10.0.0, <=10.18.3)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-23889 Source advisory: OSV:GHSA-6X96-7VC8-CM3P...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +10 more potentially affected by CVE-2026-23890 via pnpm (>=10.0.0, <=10.18.3)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-23890 Source advisory: OSV:GHSA-XPQM-WM3M-F34H...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +10 more potentially affected by CVE-2026-24056 via pnpm (>=10.0.0, <=10.18.3)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-24056 Source advisory: OSV:GHSA-M733-5W8F-5GGW...

@cedarjs/api-server (>=1.0.0-canary.12863, <=3.0.0-canary.13332), @cedarjs/cli (>=1.0.0-canary.12863, <=3.0.0-canary.13332) +13 more potentially affected by CVE-2025-55184 +1 more via react-server-dom-webpack (>=19.2.0-canary-cee7939b-20250625, <=19.2.3)

react-server-dom-webpack NPM version =19.2.0-canary-cee7939b-20250625, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...

libcrux-kem (>=0.0.2-alpha.1, <=0.0.2), libcrux-psq (0.0.2-beta.3) potentially affected by CVE-2026-76234 via libcrux-ecdh (0.0.2-beta.3)

libcrux-ecdh CARGO version 0.0.2-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ecdh and may be impacted: - libcrux-kem =0.0.2-alpha.1, =0.0.2 - libcrux-psq 0.0.2-beta.3 Source cves: CVE-2026-76234 Source advisory: OSV:RUSTSEC-2026-0023...

orval (>=8.0.0-rc.0, <=8.0.2) potentially affected by CVE-2026-24132 via @orval/mock (>=8.0.0, <=8.0.2)

@orval/mock NPM version =8.0.0, =8.0.0-rc.0, =8.0.2 Source cves: CVE-2026-24132 Source advisory: SNYK:JS-ORVALMOCK-15091570...

orval (>=8.0.0-rc.0, <=8.0.2) potentially affected by CVE-2026-24132 via @orval/mock (>=8.0.0, <=8.0.2)

@orval/mock NPM version =8.0.0, =8.0.0-rc.0, =8.0.2 Source cves: CVE-2026-24132 Source advisory: OSV:GHSA-F456-RF33-4626...

d2m-apigen (>=1.0.1, <=2.1.7), dm-apigen (>=0.0.0, <=1.0.0) +3 more potentially affected by CVE-2026-24132 via @orval/mock (>=7.0.0, <=7.19.0)

@orval/mock NPM version =7.0.0, =1.0.1, =0.0.0, =1.2.0, =7.0.0, =7.1.0, =7.13.2 Source cves: CVE-2026-24132 Source advisory: OSV:GHSA-F456-RF33-4626...

@aaronuu/react-forms (>=0.0.1, <=0.2.2), @actra-development-oss/redux-persist-transform-filter-immutable (>=0.1.1, <=1.0.0) +777 more potentially affected by CVE-2025-13465 via lodash.unset (>=4.0.2, <=4.18.0)

lodash.unset NPM version =4.0.2, =0.0.1, =0.1.1, =0.1.0, =0.0.1, =1.1.0, =0.0.4, =1.8.28, =1.1.0, =0.1.2, =0.0.1, =0.1.0, =0.0.1, =2.1.1 and more Source cves: CVE-2025-13465 Source advisory: SNYK:JS-LODASHUNSET-15053837...

@dojo/cli-test-intern (>=0.1.0, <=2.0.0-beta3.1), express_mvc (>=4.1.1, <=4.3.10) +7 more potentially affected by CVE-2025-13465 via lodash-amd (4.16.4)

lodash-amd NPM version 4.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on lodash-amd and may be impacted: - @dojo/cli-test-intern =0.1.0, =4.1.1, =3.4.0, =0.0.1, =1.0.14, =0.0.7, =0.0.1, =0.1.5 - xirtam--matrix-operations 0.1.3 Source cves:...

@akashic/akashic-cli (>=2.16.49, <=2.17.21), @akashic/akashic-cli-export (>=1.8.28, <=1.9.17) +253 more potentially affected by CVE-2025-13465 +1 more via lodash.unset (>=4.0.2, <=4.5.2)

lodash.unset NPM version =4.0.2, =2.16.49, =1.8.28, =1.2.1, =1.8.4, =8.0.0, =1.0.75, =0.0.2, =0.1.0, =1.31.9, =0.0.4, =0.6.0 and more Source cves: CVE-2025-13465, CVE-2026-2950 Source advisory: OSV:GHSA-XXJR-MMJV-4GPG...

@astrojs/cloudflare (0.4.0), @bookinghub/widget (>=0.1.0, <=0.4.0) +29 more potentially affected by CVE-2026-0933 via wrangler (>=2.0.23, <=3.114.1)

wrangler NPM version =2.0.23, =0.1.0, =0.0.1, =1.0.274, =0.1.0, =0.2.0, =2.1.0, =0.0.0-pre.2, =0.0.0-next-20230221055802, =0.1.0, =1.0.0, =0.1.1, =0.0.3, =1.0.0, =1.0.2 and more Source cves: CVE-2026-0933 Source advisory: OSV:GHSA-36P8-MVP6-CV38...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +252 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-24046 Source advisory: OSV:GHSA-RQ6Q-WR2Q-7PGP...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +252 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-24046 Source advisory:...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.7-next.1), @backstage/backend-test-utils (>=1.10.1-next.0, <=1.10.2-next.1) +14 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (0.14.0-next.1)

@backstage/backend-defaults NPM version 0.14.0-next.1 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/backend-defaults and may be impacted: - @backstage/backend-dynamic-feature-service =0.0.0-nightly-20251218024537, =1.10.1-next.0,...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-23957 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-23957 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054526...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-qofeno/agentx-cli (>=1.20.47, <=1.20.52) +122 more potentially affected by CVE-2026-23957 via seroval (>=1.0.7, <=1.3.2)

seroval NPM version =1.0.7, =0.2.5, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =0.3.2 - @entropy-tamer/reynard-config 0.1.2 - @entropy-tamer/reynard-i18n 1.2.0 - @entropy-tamer/reynard-validation 0.2.0 and more Source cves: CVE-2026-23957 Source advisory:...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-23737 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-23737 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054507...

@beshkenadze/orval-mcp (7.11.2-fix.2), @latest-version/orval-angular (7.4.1) +19 more potentially affected by CVE-2026-23947 +1 more via @orval/core (>=7.0.0, <=7.18.0)

@orval/core NPM version =7.0.0, =7.4.1, =7.4.1, =7.4.1, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.9.0, =7.0.0, =7.0.0, =7.0.0, =7.18.0 and more Source cves: CVE-2026-23947, CVE-2026-25141 Source advisory: OSV:GHSA-H526-WF6G-67JV...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @netlify/agent-runner-cli (>=1.31.0-alpha, <=1.58.1-alpha) +14 more potentially affected by CVE-2026-21852 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.64)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =1.31.0-alpha, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =0.11.1, =0.11.0, =1.0.0, =0.10.2, =0.11.5 and more Source cves: CVE-2026-21852 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-15046268...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @netlify/agent-runner-cli (>=1.31.0-alpha, <=1.58.1-alpha) +14 more potentially affected by CVE-2026-21852 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.64)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =1.31.0-alpha, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =0.11.1, =0.11.0, =1.0.0, =0.10.2, =0.11.5 and more Source cves: CVE-2026-21852 Source advisory: OSV:GHSA-JH7P-QR78-84P7...

br.com.jarch:jarch-apt (>=20.3.0, <=24.1.0), br.com.jarch:jarch-core (>=20.3.0, <=24.1.0) +32 more potentially affected by CVE-2025-65482 via fr.opensagres.xdocreport:fr.opensagres.xdocreport.document.docx (>=0.9.5, <=2.2.0)

fr.opensagres.xdocreport:fr.opensagres.xdocreport.document.docx MAVEN version =0.9.5, =20.3.0, =20.3.0, =2.23.5, =24.2.0, =23.1.0, =2.23.0, =2.0, =2.0, =2.0, =2.2.4, =2.0, =2.2.4, =2.2.4, =2.2.4, =2.2.7 and more Source cves: CVE-2025-65482 Source advisory: SNYK:JAVA-FROPENSAGRESXDOCREPORT-1504671...

10minions-engine (>=0.0.1, <=0.0.4), 3ui (>=0.1.0, <=0.1.8) +1860 more potentially affected by CVE-2026-12866 via expr-eval (>=0.12.0, <=2.0.2)

expr-eval NPM version =0.12.0, =0.0.1, =0.1.0, =1.0.2, =1.2.0, =1.0.0, =0.1.4, =0.0.1, =0.4.2, =0.4.4 - @activepieces/piece-aianswer 0.1.5 and more Source cves: CVE-2026-12866 Source advisory: SNYK:JS-EXPREVAL-15054690...

@adenta/cms (>=0.0.6, <=1.1.1-0), @adobe/helix-deploy (>=11.0.19, <=11.1.15) +316 more potentially affected by CVE-2026-23950 via tar (>=7.0.0, <=7.5.3)

tar NPM version =7.0.0, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =0.1.1, =0.1.1, =2.17.11, =1.9.5, =8.8.3, =0.0.2, =0.0.22 and more Source cves: CVE-2026-23950 Source advisory: SNYK:JS-TAR-15038581...

org.webjars.npm:canvas (>=2.5.0, <=2.6.0), org.webjars.npm:color-thief (2.2.5) +12 more potentially affected by CVE-2026-23950 via org.webjars.npm:tar (>=0.1.20, <=4.4.19)

org.webjars.npm:tar MAVEN version =0.1.20, =2.5.0, =0.97.5, =0.2.0, =3.4.0, =0.6.19, =2.0.0, =3.1.4, =3.4.1 - org.webjars.npm:tar.gz 1.0.7 Source cves: CVE-2026-23950 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15038582...

@daffaadev/baileys (1.0.1), @daffaadev/baileyss (1.0.0) potentially affected by unknown CVE via @daffadeveloper/signal-node (0.0.1-security)

@daffadeveloper/signal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @daffadeveloper/signal-node and may be impacted: - @daffaadev/baileys 1.0.1 - @daffaadev/baileyss 1.0.0 Source cves: unknown CVE Source advisory:...

net.risesoft:risenet-y9boot-support-platform-service (9.7.0-rc3), net.risesoft:risenet-y9boot-support-platform-web (9.7.0-rc3) potentially affected by CVE-2026-1050 via net.risesoft:risenet-y9boot-support-platform-jpa-repository (9.7.0-rc3)

net.risesoft:risenet-y9boot-support-platform-jpa-repository MAVEN version 9.7.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on net.risesoft:risenet-y9boot-support-platform-jpa-repository and may be impacted: -...

@adenta/cms (>=0.0.6, <=1.1.1-0), @adobe/helix-deploy (>=11.0.19, <=11.1.15) +306 more potentially affected by CVE-2026-23745 via tar (>=7.0.0, <=7.5.2)

tar NPM version =7.0.0, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =0.1.1, =0.1.1, =2.17.11, =1.9.5, =8.8.3, =0.0.2, =0.0.22 and more Source cves: CVE-2026-23745 Source advisory: OSV:GHSA-8QQ5-RM4J-MR97...

apetest (>=0.1.0, <=0.1.1), mccole (>=0.2.0, <=5.8.0) potentially affected by CVE-2025-15104 via html5validator (>=0.3.3, <=0.4.2)

html5validator PYPI version =0.3.3, =0.1.0, =0.2.0, =5.8.0 Source cves: CVE-2025-15104 Source advisory: SNYK:PYTHON-HTML5VALIDATOR-15010792...

@deno/sandbox (>=0.0.9, <=0.6.0), @ekairos/dataset (>=1.21.56-beta.0, <=1.22.22-beta.development.0) +45 more potentially affected by CVE-2026-22775 via devalue (>=5.1.1, <=5.6.0)

devalue NPM version =5.1.1, =0.0.9, =1.21.56-beta.0, =1.22.4-beta.development.0, =1.21.56-beta.0, =1.21.67-beta.0, =1.21.88-beta.0, =0.0.0-dev-20260121145510, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =0.0.0-dev-20260115183047, =2.3.97, =1.1.53, =2.0.0, =1.2.263, =3.1.3, =4.0.1 and mo...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +211 more potentially affected by CVE-2026-23527 via h3 (>=1.0.1, <=1.15.4)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: CVE-2026-23527 Source advisory: SNYK:JS-H3-15010914...

@darka-software/text-design-qwik (>=0.0.137, <=0.0.139), positron-components (>=1.12.2, <=1.12.3) potentially affected by CVE-2026-22803 via @sveltejs/kit (>=2.49.0, <=2.49.3)

@sveltejs/kit NPM version =2.49.0, =0.0.137, =1.12.2, =1.12.3 Source cves: CVE-2026-22803 Source advisory: OSV:GHSA-J2F3-WQ62-6Q46...

@0k.io/prettier (>=0.0.2, <=0.0.3), @0k/prettier (>=0.2.0, <=0.2.1) +320 more potentially affected by CVE-2026-24001 via diff (>=4.0.1, <=4.0.2)

diff NPM version =4.0.1, =0.0.2, =0.2.0, =1.2.0, =0.3.2, =0.4.0-next.6, =7.0.0-alpha.0, =7.0.0-alpha.0, =7.0.0-alpha.0, =7.0.0-alpha.0, =7.0.0-alpha.0, =0.4.0, =1.5.0, =4.0.0, =1.0.0, =2.1.0 and more Source cves: CVE-2026-24001 Source advisory: OSV:GHSA-73RR-HH4G-FPGX...

0g-serving-broker (0.1.0), 10x-cli (0.0.7) +4411 more potentially affected by CVE-2026-24001 via diff (>=6.0.0, <=8.0.2)

diff NPM version =6.0.0, =0.1.0, =1.0.0, =0.5.0, =1.0.9, =0.0.1, =0.0.1, =0.1.0, =1.0.1, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.1.8 and more Source cves: CVE-2026-24001 Source advisory: OSV:GHSA-73RR-HH4G-FPGX...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +297 more potentially affected by CVE-2026-22818 via hono (>=4.0.0, <=4.11.3)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.0.1, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =0.2.1, =0.6.1, =0.5.2, =0.0.3, =1.3.2, =1.3.17 and more Source cves: CVE-2026-22818 Source advisory: SNYK:JS-HONO-14927373...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +297 more potentially affected by CVE-2026-22818 via hono (>=4.0.0, <=4.11.3)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.0.1, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =0.2.1, =0.6.1, =0.5.2, =0.0.3, =1.3.2, =1.3.17 and more Source cves: CVE-2026-22818 Source advisory: OSV:GHSA-3VHC-576X-3QV4...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +297 more potentially affected by CVE-2026-22817 via hono (>=4.0.0, <=4.11.3)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.0.1, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =0.2.1, =0.6.1, =0.5.2, =0.0.3, =1.3.2, =1.3.17 and more Source cves: CVE-2026-22817 Source advisory: OSV:GHSA-F67F-6CW9-8MQ4...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +297 more potentially affected by CVE-2026-22817 via hono (>=4.0.0, <=4.11.3)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.0.1, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =0.2.1, =0.6.1, =0.5.2, =0.0.3, =1.3.2, =1.3.17 and more Source cves: CVE-2026-22817 Source advisory: SNYK:JS-HONO-14927374...

168wangxiao-ui (>=0.3.6, <=0.3.70), 3achatlibrary (>=1.0.0, <=1.0.9) +5450 more potentially affected by CVE-2025-15056 via quill (>=0.19.14, <=2.0.3)

quill NPM version =0.19.14, =0.3.6, =1.0.0, =19.0.0, =1.0.1, =1.0.0, =1.0.10, =3.1.1-0, =2.10.1, =0.1.6, =1.0.7, =19.0.0, =19.1.0 and more Source cves: CVE-2025-15056 Source advisory: SNYK:JS-QUILL-14927397...

@cenk1cenk2/renovate-config (>=2.3.95, <=2.3.148), @jamietanna/patch-testing (>=0.1.0, <=0.2.28) +7 more potentially affected by CVE-2026-76230 via renovate (>=35.159.7, <=40.21.2)

renovate NPM version =35.159.7, =2.3.95, =0.1.0, =0.7.0, =0.5.0, =0.1.0, =0.2.0, =0.0.1, =0.19.0 - @zotero-chinese/renovate-config 1.0.3 Source cves: CVE-2026-76230 Source advisory: OSV:GHSA-FR4J-65PV-GJJJ...

@jamietanna/renovate-graph (>=0.24.0, <=0.30.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (>=0.6.5, <=1.0.1) potentially affected by CVE-2026-76229 via renovate (>=39.230.2, <=40.21.2)

renovate NPM version =39.230.2, =0.24.0, =0.6.5, =1.0.1 Source cves: CVE-2026-76229 Source advisory: OSV:GHSA-XV56-3WQ5-9997...