7ghost (>=4.11.0, <=4.11.46), @accordproject/concerto-ui-react (>=0.6.0-alpha.1, <=0.83.1-20200224151908) +271 more potentially affected by CVE-2025-61140 via jsonpath (>=1.0.0, <=1.1.1)

jsonpath NPM version =1.0.0, =4.11.0, =0.6.0-alpha.1, =0.82.10-20200221024018, =1.0.0, =1.1.0-dev.2, =3.0.6371, =4.0.2, =2.0.4, =0.2.0-dev.1, =4.0.149, =3.0.129, =4.0.174, =0.11.8, =1.2.5, =1.4.0 and more Source cves: CVE-2025-61140 Source advisory: OSV:GHSA-6C59-MWGH-R2X6...

@antora/cli (>=2.3.2, <=3.0.0-alpha.9), @antora/playbook-builder (>=2.3.2, <=3.0.0-alpha.9) +54 more potentially affected by CVE-2026-33864 via convict (>=6.0.0, <=6.2.2)

convict NPM version =6.0.0, =2.3.2, =2.3.2, =2.3.2, =1.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0 and more Source cves: CVE-2026-33864 Source advisory: SNYK:JS-CONVICT-15182994...

com.github.liuyueyi.media:svg-core (>=2.5, <=3.0.0) potentially affected by CVE-2026-24806 via com.github.liuyueyi.media:batik-codec-fix (>=2.5, <=3.0.0)

com.github.liuyueyi.media:batik-codec-fix MAVEN version =2.5, =2.5, =3.0.0 Source cves: CVE-2026-24806 Source advisory: SNYK:JAVA-COMGITHUBLIUYUEYIMEDIA-15127912...

9remote (>=0.1.0, <=0.1.8), @alecpapierniak/mcp-manager (>=0.1.0, <=0.1.2) +105 more potentially affected by CVE-2025-59471 +1 more via next (>=16.1.1, <=16.1.4)

next NPM version =16.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =1.0.8, =0.3.0, =0.0.0-canary-20260113162409, =1.53.0 and more Source cves: CVE-2025-59471, CVE-2025-59472 Source advisory: SNYK:JS-NEXT-15104645...

@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +212 more potentially affected by CVE-2025-55184 +1 more via next (>=15.2.0, <=15.2.8)

next NPM version =15.2.0, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: CVE-2025-55184, CVE-2026-238...

d2m-apigen (>=1.0.1, <=2.1.7), dm-apigen (>=0.0.0, <=1.0.0) +3 more potentially affected by CVE-2026-24132 via @orval/mock (>=7.0.0, <=7.19.0)

@orval/mock NPM version =7.0.0, =1.0.1, =0.0.0, =1.2.0, =7.0.0, =7.1.0, =7.13.2 Source cves: CVE-2026-24132 Source advisory: SNYK:JS-ORVALMOCK-15091570...

d2m-apigen (>=1.0.1, <=2.1.7), dm-apigen (>=0.0.0, <=1.0.0) +3 more potentially affected by CVE-2026-24132 via @orval/mock (>=7.0.0, <=7.19.0)

@orval/mock NPM version =7.0.0, =1.0.1, =0.0.0, =1.2.0, =7.0.0, =7.1.0, =7.13.2 Source cves: CVE-2026-24132 Source advisory: OSV:GHSA-F456-RF33-4626...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-24006 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-24006 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054528...

@astrojs/cloudflare (0.4.0), @bookinghub/widget (>=0.1.0, <=0.4.0) +29 more potentially affected by CVE-2026-0933 via wrangler (>=2.0.23, <=3.114.1)

wrangler NPM version =2.0.23, =0.1.0, =0.0.1, =1.0.274, =0.1.0, =0.2.0, =2.1.0, =0.0.0-pre.2, =0.0.0-next-20230221055802, =0.1.0, =1.0.0, =0.1.1, =0.0.3, =1.0.0, =1.0.2 and more Source cves: CVE-2026-0933 Source advisory: OSV:GHSA-36P8-MVP6-CV38...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.0), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.0) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.0-next.0, <=0.12.2-next.1)

@backstage/plugin-scaffolder-node NPM version =0.12.0-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.3.15-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.3.14-next.1, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.9.1-next.1,...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-23737 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-23737 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054507...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @netlify/agent-runner-cli (>=1.31.0-alpha, <=1.58.1-alpha) +14 more potentially affected by CVE-2026-21852 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.64)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =1.31.0-alpha, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =0.11.1, =0.11.0, =1.0.0, =0.10.2, =0.11.5 and more Source cves: CVE-2026-21852 Source advisory: OSV:GHSA-JH7P-QR78-84P7...

@abuiles/vite-plugin (>=1.8.0, <=1.10.0), @anyauth/design-system (>=0.5.0, <=0.5.1) +20 more potentially affected by CVE-2026-0933 via wrangler (>=4.0.0, <=4.59.0)

wrangler NPM version =4.0.0, =1.8.0, =0.5.0, =12.6.6, =0.1.11, =0.8.0, =0.2.0, =0.0.0, =0.0.0-snapshot-001db2706f44e8ac35b9064bbbc2b6f14b577447, =1.0.6, =0.0.0-5788407, =0.0.25, =0.16.0, =1.0.0, =1.1.3 and more Source cves: CVE-2026-0933 Source advisory: SNYK:JS-WRANGLER-15046269...

@beshkenadze/orval-mcp (7.11.2-fix.2), @orval/angular (>=7.10.0, <=7.18.0) +11 more potentially affected by CVE-2026-23947 via @orval/core (>=7.10.0, <=7.18.0)

@orval/core NPM version =7.10.0, =7.10.0, =7.10.0, =7.10.0, =7.10.0, =7.10.0, =7.10.0, =7.10.0, =7.10.0, =7.10.0, =1.0.1, =7.10.0, =7.10.0, =7.13.2 Source cves: CVE-2026-23947 Source advisory: SNYK:JS-ORVALCORE-15038726...

@veramo/kv-store (>=6.0.0, <=6.0.1) potentially affected by unknown CVE via @veramo/core-types (>=6.0.0, <=6.0.1-next.54)

@veramo/core-types NPM version =6.0.0, =6.0.0, =6.0.1 Source cves: unknown CVE Source advisory: SNYK:JS-VERAMOCORETYPES-15032936...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +215 more potentially affected by CVE-2026-23527 via h3 (>=1.0.1, <=1.15.4)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: CVE-2026-23527 Source advisory: SNYK:JS-H3-15010914...

@alexaegis/svelte-config (>=0.14.0, <=0.14.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=1.2.0, <=2.1.0) +5 more potentially affected by CVE-2025-67647 via @sveltejs/kit (>=2.20.7, <=2.49.3)

@sveltejs/kit NPM version =2.20.7, =0.14.0, =1.2.0, =0.0.137, =0.0.1, =1.0.1-next.0, =0.0.1, =1.3.0, =1.12.3 Source cves: CVE-2025-67647 Source advisory: SNYK:JS-SVELTEJSKIT-14996725...

arakawa (0.1.0-alpha.1), vega (>=6.0.0, <=6.1.2) +1 more potentially affected by CVE-2025-66648 via vega-functions (6.0.0)

vega-functions NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on vega-functions and may be impacted: - arakawa 0.1.0-alpha.1 - vega =6.0.0, =6.0.0, =6.1.2 Source cves: CVE-2025-66648 Source advisory: OSV:GHSA-M9RG-MR6G-75GM...

@cedarjs/api-server (>=1.0.0-canary.12879, <=1.0.0-canary.12881), @cedarjs/cli (>=1.0.0-canary.12879, <=1.0.0-canary.12881) +10 more potentially affected by CVE-2025-67779 via react-server-dom-webpack (19.2.2)

react-server-dom-webpack NPM version 19.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @cedarjs/api-server =1.0.0-canary.12879, =1.0.0-canary.12879, =1.0.0-canary.12879, =1.0.0-canary.12879,...

@cedarjs/api-server (>=1.0.0-canary.12879, <=1.0.0-canary.12881), @cedarjs/cli (>=1.0.0-canary.12879, <=1.0.0-canary.12881) +10 more potentially affected by CVE-2025-55183 +2 more via react-server-dom-webpack (19.2.2)

react-server-dom-webpack NPM version 19.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @cedarjs/api-server =1.0.0-canary.12879, =1.0.0-canary.12879, =1.0.0-canary.12879, =1.0.0-canary.12879,...

@atomos_tech/katerpillar (1.0.0), katalyst-riya-test (>=1.0.0, <=1.0.3) potentially affected by CVE-2025-55183 +2 more via next (15.4.9)

next NPM version 15.4.9 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @atomostech/katerpillar 1.0.0 - katalyst-riya-test =1.0.0, =1.0.3 Source cves: CVE-2025-55183, CVE-2025-55184, CVE-2025-67779 Source advisory:...

47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +178 more potentially affected by unknown CVE via next (>=15.5.1, <=15.5.7)

next NPM version =15.5.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MWV6-3258-Q52C...

@smg-automotive/auth (>=6.8.0-auth0-update-access-token-endpoint.1, <=8.3.0-lschuerch-FED-782-sync-tenant.7) potentially affected by CVE-2025-67716 via @auth0/nextjs-auth0 (>=4.9.0, <=4.12.1)

@auth0/nextjs-auth0 NPM version =4.9.0, =6.8.0-auth0-update-access-token-endpoint.1, =8.3.0-lschuerch-FED-782-sync-tenant.7 Source cves: CVE-2025-67716 Source advisory: OSV:GHSA-MR6F-H57V-RPJ5...

@atonis/cli (3.0.15) potentially affected by CVE-2025-65513 via mcp-fetch-server (1.1.2)

mcp-fetch-server NPM version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on mcp-fetch-server and may be impacted: - @atonis/cli 3.0.15 Source cves: CVE-2025-65513 Source advisory: SNYK:JS-MCPFETCHSERVER-14287685...

@10play/tentap-editor (>=0.5.27, <=0.7.5-alpha.0), @adminjs/design-system (>=3.0.0-beta.4, <=4.1.1) +227 more potentially affected by CVE-2025-14284 via @tiptap/extension-link (>=2.0.0, <=2.10.3)

@tiptap/extension-link NPM version =2.0.0, =0.5.27, =3.0.0-beta.4, =1.0.0-beta.1, =0.4.1, =1.4.8, =2.0.6, =3.1.65, =3.0.0-alpha.1, =0.0.1, =0.2.1-alpha.0, =0.2.0, =0.0.1, =1.2.39, =1.2.277 - @chirpy-dev/analytics 0.0.1 and more Source cves: CVE-2025-14284 Source advisory: OSV:GHSA-VHRC-HGRQ-X75R...

alerter (>=0.3.0, <=0.3.2), crate_glitch (0.2.0) +14 more potentially affected by CVE-2025-66622 via matrix-sdk-base (>=0.1.0, <=0.5.1)

matrix-sdk-base CARGO version =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.10-alpha, =0.13.0, =0.13.1 and more Source cves: CVE-2025-66622 Source advisory: OSV:GHSA-JJ6P-3M75-G2P3...

00ld8nuivn (2.1.0), 00rqiw31nd (2.1.0) +3708 more potentially affected by CVE-2025-65945 via jws (>=3.0.0, <=3.2.2)

jws NPM version =3.0.0, =3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on jws and may be impacted: - 00ld8nuivn 2.1.0 - 00rqiw31nd 2.1.0 - 01dk01majk 2.1.0 - 02rjq8i863 1.1.0 - 02vx8qsp01 2.1.0 - 05y6tjgmws 1.1.0 - 066m7q8o0z 2.1.0 - 06buj9h3su...

@accounter/client (>=0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, <=0.0.3-alpha-20241210194047-ed4829d58a27c1aa9634b834f5d56d78ce8c68fd), @admiral.nelson/smart-catalyst (>=1.0.19, <=1.0.24) +254 more potentially affected by CVE-2025-55182 +1 more via next (>=14.3.0-canary.24, <=15.0.4-canary.39)

next NPM version =14.3.0-canary.24, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =1.0.19, =0.1.0, =0.0.4, =0.1.0, =0.1.11, =0.0.1-alpha, =0.0.1, =0.0.1, =3.0.0, =1.0.0, =1.0.30 - @benimaru/ahgas 1.1.4 - @benimaru/asduq 1.1.4 and more Source cves: CVE-2025-55182,...

@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +210 more potentially affected by CVE-2025-55182 +1 more via next (>=15.2.0, <=15.2.5)

next NPM version =15.2.0, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: CVE-2025-55182, CVE-2025-664...

@redwoodjs/sdk (>=0.0.63-test.2, <=0.0.79), @storybook/experimental-nextjs-rsc (>=0.0.0-pr-31893-sha-392fa9a5, <=0.0.0-pr-31893-sha-f0bf2189) +1 more potentially affected by CVE-2025-55182 via react-server-dom-webpack (19.2.0-canary-39cad7af-20250411)

react-server-dom-webpack NPM version 19.2.0-canary-39cad7af-20250411 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @redwoodjs/sdk =0.0.63-test.2, =0.0.0-pr-31893-sha-392fa9a5, =0.0.79-test.2025050614455...

@4399ywkf/router (>=0.0.1, <=0.0.4), @akash-aw/aw-wizard-forms (4.14.0) +125 more potentially affected by CVE-2025-55182 via @modern-js/utils (>=2.65.2, <=2.69.2)

@modern-js/utils NPM version =2.65.2, =0.0.1, =1.0.0, =1.0.0, =0.44.0, =2.23.0, =0.3.53, =1.0.1, =0.30.0, =0.3.0-alpha.1, =0.4.3, =1.3.0, =2.0.0 and more Source cves: CVE-2025-55182 Source advisory: SNYK:JS-MODERNJSUTILS-14723360...

ai-sdk-provider-claude-code (>=0.2.0, <=1.1.1), claude-code-webui (>=0.1.34, <=0.1.50) +6 more potentially affected by CVE-2025-66032 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.90)

@anthropic-ai/claude-code NPM version =1.0.8, =0.2.0, =0.1.34, =1.8.0, =0.1.44, =0.0.22, =0.0.27, =0.0.28 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-66032 Source advisory: OSV:GHSA-XQ4M-MC3C-VVG3...

ai-sdk-provider-claude-code (>=0.2.0, <=1.1.1), claude-code-webui (>=0.1.34, <=0.1.50) +6 more potentially affected by CVE-2025-66032 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.90)

@anthropic-ai/claude-code NPM version =1.0.8, =0.2.0, =0.1.34, =1.8.0, =0.1.44, =0.0.22, =0.0.27, =0.0.28 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-66032 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-14176027...

@0xfutbol/id (>=2.0.0, <=2.0.200), @0xkamal7/sui-agent (>=1.1.2, <=1.1.5) +1794 more potentially affected by CVE-2025-66020 via valibot (>=0.31.0, <=1.1.0)

valibot NPM version =0.31.0, =2.0.0, =1.1.2, =1.2.0-pre.92, =1.2.0-pre.24, =1.2.0-pre.24, =0.0.1, =0.0.1, =0.0.1, =1.2.0-pre.64, =0.0.1, =0.0.1, =0.5.9, =0.5.18, =0.0.2-beta.0, =0.2.0 - @0xsquid/mpp 0.2.0 and more Source cves: CVE-2025-66020 Source advisory: SNYK:JS-VALIBOT-14122017...

@laboratory-one/api-components (>=0.0.22, <=26.63.0) potentially affected by CVE-2025-65944 via @sentry/nestjs (10.12.0)

@sentry/nestjs NPM version 10.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on @sentry/nestjs and may be impacted: - @laboratory-one/api-components =0.0.22, =26.63.0 Source cves: CVE-2025-65944 Source advisory: OSV:GHSA-6465-JGVQ-JHGP...

@doist/ui-extensions-server (3.5.7), @fdm-monster/server (1.9.1) +53 more potentially affected by CVE-2025-65944 via @sentry/core (>=10.11.0, <=10.26.0)

@sentry/core NPM version =10.11.0, =0.0.22, =0.1.0, =0.34.0, =0.34.0, =0.34.0, =0.34.0, =0.34.0, =12.1.0, =0.0.19, =10.11.0, =10.26.0 and more Source cves: CVE-2025-65944 Source advisory: SNYK:JS-SENTRYCORE-14105053...

@bpa-solutions/assistant (>=13.5.0-dev, <=13.5.0), @mazaal-dev/piece-markdown-to-pdf (0.0.2) +2 more potentially affected by CVE-2025-65108 via md-to-pdf (>=5.0.1, <=5.2.4)

md-to-pdf NPM version =5.0.1, =13.5.0-dev, =0.11.1, =0.5.52, =0.5.74 Source cves: CVE-2025-65108 Source advisory: SNYK:JS-MDTOPDF-14089788...

ai-sdk-provider-claude-code (>=0.2.0, <=1.0.0-beta.1), locadex (0.0.2-alpha.1) potentially affected by CVE-2025-65099 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.24)

@anthropic-ai/claude-code NPM version =1.0.8, =0.2.0, =1.0.0-beta.1 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-65099 Source advisory: OSV:GHSA-5HHX-V7F6-X7GV...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +27 more potentially affected by CVE-2025-64757 via astro (>=5.0.0-beta.5, <=5.14.1)

astro NPM version =5.0.0-beta.5, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.0-dev-20250414184926, =1.13.2, =0.0.1, =0.0.1, =1.0.21, =1.0.22 - @vdart-code/web 1.19.0 and more Source cves: CVE-2025-64757 Source advisory: SNYK:JS-ASTRO-14059139...

dev.savantly.nexus:agents-module (3.4.0), dev.savantly.nexus:flow-module (3.4.0) +129 more potentially affected by CVE-2025-64408 via org.apache.causeway.core:causeway-core-metamodel (>=2.0.0, <=4.0.0-m2)

org.apache.causeway.core:causeway-core-metamodel MAVEN version =2.0.0, =4.0.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.causeway.core:causeway-core-metamodel and may be impacted: - dev.savantly.nexus:agents-module 3.4.0 -...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.3.0, <=2.9.4)

@apollo/composition NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2025-64530 Source advisory: OSV:GHSA-MX7M-J9XF-62HW...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.10.0, <=2.10.3)

@apollo/composition NPM version =2.10.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2025-64530 Source advisory: OSV:GHSA-MX7M-J9XF-62HW...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +31 more potentially affected by CVE-2025-64745 via astro (>=5.2.1, <=5.15.1)

astro NPM version =5.2.1, =0.0.1, =1.0.0, =0.5.0, =0.0.1, =0.1.0, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.28, =0.0.28, =0.0.40 and more Source cves: CVE-2025-64745 Source advisory: SNYK:JS-ASTRO-13961435...

org.webjars.npm:vega-embed (6.21.0) potentially affected by CVE-2025-59840 via org.webjars.npm:vega-interpreter (1.0.4)

org.webjars.npm:vega-interpreter MAVEN version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:vega-interpreter and may be impacted: - org.webjars.npm:vega-embed 6.21.0 Source cves: CVE-2025-59840 Source advisory:...

@akunsansan0/teagunz99 (>=1.1.2, <=1.1.4) potentially affected by unknown CVE via teagunz99 (1.0.0)

teagunz99 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on teagunz99 and may be impacted: - @akunsansan0/teagunz99 =1.1.2, =1.1.4 Source cves: unknown CVE Source advisory: OSV:MAL-2025-181574...

@akunsansan0/tea_gunt99 (1.1.4) potentially affected by unknown CVE via tea_gunt99 (1.1.2)

teagunt99 NPM version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on teagunt99 and may be impacted: - @akunsansan0/teagunt99 1.1.4 Source cves: unknown CVE Source advisory: OSV:MAL-2025-181569...

siddheshtea (1.1.6) potentially affected by unknown CVE via manda-24 (1.0.0)

manda-24 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on manda-24 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-159620...

@accounter/server (>=0.0.1-alpha-20240307145247-66232ffd2f926ee16fb5781f8c93d98fdf4d1416, <=0.0.3-alpha-20241114141215-09b7d417e7e139562b2a77a6eb2d990da536e1ec), @dossierhq/test-data (1.0.1) +4 more potentially affected by CVE-2025-12613 via cloudinary (>=2.0.3, <=2.6.1)

cloudinary NPM version =2.0.3, =0.0.1-alpha-20240307145247-66232ffd2f926ee16fb5781f8c93d98fdf4d1416, =7.1.0, =1.0.0-alpha.88, =1.0.0-alpha.88, =0.0.1, =0.0.6 Source cves: CVE-2025-12613 Source advisory: OSV:GHSA-G4MF-96X5-5M2C...

@react-native-community/cli (>=19.0.0-alpha.0, <=19.1.1) potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (>=19.0.0, <=19.1.1)

@react-native-community/cli-server-api NPM version =19.0.0, =19.0.0-alpha.0, =19.1.1 Source cves: CVE-2025-11953 Source advisory: SNYK:JS-REACTNATIVECOMMUNITYCLISERVERAPI-13836141...

@fluentui-react-native/tester (>=0.170.52, <=0.170.57), @fluentui-react-native/tester-win32-81 (>=0.38.69, <=0.38.70) +3 more potentially affected by CVE-2025-11953 via @react-native-community/cli-server-api (17.0.0)

@react-native-community/cli-server-api NPM version 17.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @react-native-community/cli-server-api and may be impacted: - @fluentui-react-native/tester =0.170.52, =0.38.69, =0.81.4, =0.81.5, =0.81.37 Source...