@tinacms/app (>=0.0.0-0b7103c-20251216023146, <=2.3.25), @tinacms/cli (>=0.0.0-0b7103c-20251216023146, <=2.1.6) +4 more potentially affected by CVE-2026-28791 via @tinacms/graphql (>=2.0.0, <=2.1.2)

@tinacms/graphql NPM version =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =3.5.0 Source cves: CVE-2026-28791 Source advisory: SNYK:JS-TINACMSGRAPHQL-15518326...

@tinacms/app (>=0.0.0-0b7103c-20251216023146, <=2.3.24), @tinacms/cli (>=0.0.0-0b7103c-20251216023146, <=2.1.5) +4 more potentially affected by CVE-2026-24125 via @tinacms/graphql (>=2.0.0, <=2.1.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =3.4.1 Source cves: CVE-2026-24125 Source advisory: OSV:GHSA-2238-XC5R-V9HJ...

@studiocms/migrator (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-32104 via studiocms (>=0.2.0, <=0.3.0)

studiocms NPM version =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2026-32104 Source advisory: OSV:GHSA-9V82-XRM4-MP52...

@backstage-community/plugin-catalog-backend-module-keycloak (>=3.4.0, <=3.17.2), @dedel.alex/keycloak-admin-client-cjs (>=26.0.4, <=26.1.4) +7 more potentially affected by CVE-2026-2366 via @keycloak/keycloak-admin-client (>=26.0.0, <=26.5.5)

@keycloak/keycloak-admin-client NPM version =26.0.0, =3.4.0, =26.0.4, =26.0.0, =26.0.0, =26.0.0, =2.1.1, =0.0.7, =0.1.1 Source cves: CVE-2026-2366 Source advisory: OSV:GHSA-R8JR-WG88-FQ5C...

@studiocms/migrator (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-32106 via studiocms (>=0.2.0, <=0.3.0)

studiocms NPM version =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2026-32106 Source advisory: SNYK:JS-STUDIOCMS-15666774...

@0xwork/connect (>=0.1.0, <=0.1.9), @agenr/agenr-plugin (>=1.6.0, <=3.2.0) +170 more potentially affected by CVE-2026-30741 via openclaw (>=0.0.1, <=2026.7.1-2)

openclaw NPM version =0.0.1, =0.1.0, =1.6.0, =1.1.0, =0.1.0, =1.0.5, =0.3.5, =1.0.3, =0.0.1, =0.1.0, =1.0.9, =2026.2.4, =2026.3.3 and more Source cves: CVE-2026-30741 Source advisory: SNYK:JS-OPENCLAW-15627890...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +408 more potentially affected by CVE-2026-56763 via hono (>=4.0.0, <=4.12.6)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =0.0.25 and more Source cves: CVE-2026-56763 Source advisory: OSV:GHSA-V8W9-8MX6-G223...

actix-hash (0.5.0), actix-web-lab-derive (0.21.0) +10 more potentially affected by unknown CVE via actix-web-lab (>=0.18.9, <=0.21.0)

actix-web-lab CARGO version =0.18.9, =0.1.16, =0.1.0, =0.2.2, =0.1.1, =0.1.0, =0.1.0, =0.1.2 Source cves: unknown CVE Source advisory: OSV:GHSA-VHJ5-X93P-67JW...

@studiocms/migrator (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-30945 via studiocms (>=0.2.0, <=0.3.0)

studiocms NPM version =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2026-30945 Source advisory: SNYK:JS-STUDIOCMS-15518585...

studiocms (>=0.1.0-beta.26, <=0.1.0) potentially affected by CVE-2026-30945 via @withstudiocms/auth-kit (0.1.0-beta.6)

@withstudiocms/auth-kit NPM version 0.1.0-beta.6 is affected by a known vulnerability. The following packages have a transitive dependency on @withstudiocms/auth-kit and may be impacted: - studiocms =0.1.0-beta.26, =0.1.0 Source cves: CVE-2026-30945 Source advisory:...

org.webjars.npm:g-status (2.0.2), org.webjars.npm:graphql-toolkit__git-loader (0.7.5) potentially affected by CVE-2022-25912 +1 more via org.webjars.npm:simple-git (>=1.129.0, <=1.132.0)

org.webjars.npm:simple-git MAVEN version =1.129.0, =1.132.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:simple-git and may be impacted: - org.webjars.npm:g-status 2.0.2 - org.webjars.npm:graphql-toolkitgit-loader 0.7.5 Source cves:...

3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +483 more potentially affected by CVE-2026-28292 via simple-git (>=3.15.0, <=3.32.2)

simple-git NPM version =3.15.0, =1.0.1, =1.0.1, =0.0.0-aj-beta.7, =23.0.0, =35.0.0, =1.4.0, =0.1.5-alpha.0, =1.0.2, =8.7.2, =39.0.2, =0.0.1, =0.0.8 and more Source cves: CVE-2026-28292 Source advisory: OSV:GHSA-R275-FR43-PM7Q...

3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +483 more potentially affected by CVE-2022-25912 +1 more via simple-git (>=3.15.0, <=3.32.2)

simple-git NPM version =3.15.0, =1.0.1, =1.0.1, =0.0.0-aj-beta.7, =23.0.0, =35.0.0, =1.4.0, =0.1.5-alpha.0, =1.0.2, =8.7.2, =39.0.2, =0.0.1, =0.0.8 and more Source cves: CVE-2022-25912, CVE-2026-28292 Source advisory: SNYK:JS-SIMPLEGIT-15457646...

studiocms (>=0.1.0-beta.26, <=0.1.0) potentially affected by CVE-2026-30944 via @withstudiocms/auth-kit (0.1.0-beta.6)

@withstudiocms/auth-kit NPM version 0.1.0-beta.6 is affected by a known vulnerability. The following packages have a transitive dependency on @withstudiocms/auth-kit and may be impacted: - studiocms =0.1.0-beta.26, =0.1.0 Source cves: CVE-2026-30944 Source advisory:...

@oneuptime/cli (>=10.0.5, <=10.0.17) potentially affected by CVE-2026-30887 via @oneuptime/common (>=10.0.5, <=10.0.17)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.17 Source cves: CVE-2026-30887 Source advisory: SNYK:JS-ONEUPTIMECOMMON-15440733...

@powersync/cli-core (>=0.0.0-dev-20260305082615, <=0.9.2), @powersync/cli-plugin-config-edit (>=0.0.0-dev-20260305082615, <=0.9.2) +12 more potentially affected by CVE-2026-30870 via @powersync/service-core (1.20.0)

@powersync/service-core NPM version 1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on @powersync/service-core and may be impacted: - @powersync/cli-core =0.0.0-dev-20260305082615, =0.0.0-dev-20260305082615, =0.0.0-dev-20260305082615,...

@powersync/cli-core (>=0.0.0-dev-20260305082615, <=0.9.2), @powersync/cli-plugin-config-edit (>=0.0.0-dev-20260305082615, <=0.9.2) +19 more potentially affected by CVE-2026-30870 via @powersync/service-sync-rules (0.32.0)

@powersync/service-sync-rules NPM version 0.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on @powersync/service-sync-rules and may be impacted: - @powersync/cli-core =0.0.0-dev-20260305082615, =0.0.0-dev-20260305082615, =0.0.0-dev-20260305082615,...

@chrisleekr/mcp-server-playground (>=1.1.0-dev-0d04f54.1, <=1.1.2), @intlayer/backend (>=7.0.9-canary.2, <=7.5.9) +29 more potentially affected by CVE-2026-30827 via express-rate-limit (8.2.1)

express-rate-limit NPM version 8.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on express-rate-limit and may be impacted: - @chrisleekr/mcp-server-playground =1.1.0-dev-0d04f54.1, =7.0.9-canary.2, =1.597.450, =4.0.0, =3.1.0, =0.0.1-canary.1, =0.42.0...

@george.talusan/node-red-contrib-copilot (>=0.0.5, <=1.0.5), @github/copilot-sdk (>=0.1.9, <=0.1.31-unstable.0) +19 more potentially affected by CVE-2026-29783 via @github/copilot (>=0.0.375, <=0.0.421)

@github/copilot NPM version =0.0.375, =0.0.5, =0.1.9, =1.1.0, =0.0.0, =0.13.0, =0.0.1, =1.2.3, =0.6.0, =1.0.1, =0.1.0, =1.0.0, =1.0.0, =1.0.15 - devdoctor-js 0.1.0 and more Source cves: CVE-2026-29783 Source advisory: SNYK:JS-GITHUBCOPILOT-15468228...

@fonoster/rox (>=0.0.4, <=0.3.7) potentially affected by CVE-2024-43035 via @fonoster/voice (>=0.2.44, <=0.3.31)

@fonoster/voice NPM version =0.2.44, =0.0.4, =0.3.7 Source cves: CVE-2024-43035 Source advisory: SNYK:JS-FONOSTERVOICE-15444910...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +395 more potentially affected by CVE-2026-29045 via hono (>=4.0.0, <=4.12.3)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =0.0.25 and more Source cves: CVE-2026-29045 Source advisory: SNYK:JS-HONO-15419466...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @adenta/cms (>=0.0.6, <=1.1.1-0) +559 more potentially affected by CVE-2026-29786 via tar (>=7.0.0, <=7.5.9)

tar NPM version =7.0.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =0.1.1, =0.1.1, =2.17.11, =1.9.5, =1.0.2, =8.8.3, =8.11.4 - @altipla/directus-sdk-utils 0.7.2 - @applitools/core 4.20.0 - @applitools/core-base 1.17.0 - @applitools/ec-client 1.9.6 and more Source cves: CVE-2026-29786 Source...

5ug-cli (>=1.0.72, <=1.4.0), @343dev/optimizt (6.0.0) +85 more potentially affected by CVE-2026-29074 via svgo (>=2.1.0, <=2.8.0)

svgo NPM version =2.1.0, =1.0.72, =1.1.2, =2.0.0-fix-trigger-remove-colors-config-e26731597751d1581014163b7e73df159cf80be3.1, =0.0.2-0, =4.55.0, =2.12.3-canary.621.15219.0, =2.1.0-beta-1, =2.1.0-beta-1, =2.1.8, =5.0.0, =0.0.1, =2.7.4, =3.59.1--canary.1316.b3452bb.0, =4.0.0--canary.2146.fe4f461.0...

better-auth-cloudflare (0.1.0), next-ai-draw-io (0.4.10) potentially affected by CVE-2026-3125 via @opennextjs/cloudflare (>=1.0.1, <=1.14.8)

@opennextjs/cloudflare NPM version =1.0.1, =1.14.8 is affected by a known vulnerability. The following packages have a transitive dependency on @opennextjs/cloudflare and may be impacted: - better-auth-cloudflare 0.1.0 - next-ai-draw-io 0.4.10 Source cves: CVE-2026-3125 Source advisory:...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +395 more potentially affected by CVE-2026-29086 via hono (>=4.0.0, <=4.12.3)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =0.0.25 and more Source cves: CVE-2026-29086 Source advisory: OSV:GHSA-5PQ2-9X2X-5P6W...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +669 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-html-support (>=29.2.0, <=47.5.0-alpha.8)

@ckeditor/ckeditor5-html-support NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =42.0.1, =2.0.0, =0.7.0, =0.0.6, =1.0.1, =0.0.1, =0.0.1, =1.0.0, =36.0.0, =0.0.2, =0.0.31 and more Source cves: CVE-2026-28343 Source advisory: OSV:GHSA-JRQM-VMQC-GM93...

pqc-combo (0.1.0), pqc-fips (0.0.3) +1 more potentially affected by unknown CVE via libcrux-ml-dsa (0.0.4)

libcrux-ml-dsa CARGO version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ml-dsa and may be impacted: - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0077...

pqc-combo (0.1.0), pqc-fips (0.0.3) +1 more potentially affected by unknown CVE via libcrux-ml-dsa (0.0.4)

libcrux-ml-dsa CARGO version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ml-dsa and may be impacted: - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0076...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2059 more potentially affected by CVE-2026-0540 via dompurify (>=3.0.0, <=3.3.1)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =0.2.10 and more Source cves: CVE-2026-0540 Source advisory: SNYK:JS-DOMPURIFY-15371376...

@0xgg/echomd (>=1.0.0, <=1.0.4), @7nohe/vite-plugin-vue-marked (0.2.1) +1085 more potentially affected by CVE-2026-0540 via dompurify (>=2.0.0, <=2.5.8)

dompurify NPM version =2.0.0, =1.0.0, =0.2.0-beta.9, =0.2.0-beta.13, =6.2.3, =6.4.3, =0.0.2-next.4, =0.3.0, =0.1.0, =0.1.0-a0, =1.0.0, =0.4.0, =0.0.18, =0.0.32 and more Source cves: CVE-2026-0540 Source advisory: SNYK:JS-DOMPURIFY-15371376...

org.glassfish.mq:mq-client (>=6.4.0, <=6.9.0), org.glassfish.mq:mq-cluster (>=6.4.0, <=6.9.0) +12 more potentially affected by CVE-2026-22886 via org.glassfish.mq:mqbroker-core (>=6.4.0, <=6.9.0)

org.glassfish.mq:mqbroker-core MAVEN version =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.9.0 Source cves: CVE-2026-22886 Source advisory: SNYK:JAVA-ORGGLASSFISHMQ-15444256...

@activeboxes/piece-gmail (0.8.1), @activeboxes/piece-imap (0.2.10) +77 more potentially affected by CVE-2026-3455 via mailparser (>=3.0.0, <=3.9.1)

mailparser NPM version =3.0.0, =0.6.0, =0.0.1, =0.0.1, =1.0.0, =0.5.0, =1.0.64-alpha, =1.0.21-alpha, =4.0.1-alpha, =6.1.180-alpha and more Source cves: CVE-2026-3455 Source advisory: OSV:GHSA-7GMJ-H9XC-MCXC...

org.webjars.npm:nestjs__platform-express (>=8.4.7, <=9.0.0-next.2) potentially affected by CVE-2026-2359 via org.webjars.npm:multer (1.4.4-lts.1)

org.webjars.npm:multer MAVEN version 1.4.4-lts.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:multer and may be impacted: - org.webjars.npm:nestjsplatform-express =8.4.7, =9.0.0-next.2 Source cves: CVE-2026-2359 Source advisory:...

com.github.psi-probe:psi-probe-tomcat10 (>=5.0.0, <=5.4.0), com.github.psi-probe:psi-probe-tomcat11 (>=5.0.0, <=5.4.0) +5 more potentially affected by CVE-2026-3269 via com.github.psi-probe:psi-probe-core (>=3.0.0, <=5.4.0)

com.github.psi-probe:psi-probe-core MAVEN version =3.0.0, =5.0.0, =5.0.0, =3.0.0.rc2, =3.0.0.rc2, =3.0.0.rc2, =3.0.0.rc2, =3.0.0.rc2, =5.4.0 Source cves: CVE-2026-3269 Source advisory: SNYK:JAVA-COMGITHUBPSIPROBE-15369738...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1257 more potentially affected by CVE-2026-27942 via fast-xml-parser (>=5.0.1, <=5.3.7)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =0.5.3, =0.2.1, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =1.10.0 and more Source cves: CVE-2026-27942 Source advisory: OSV:GHSA-FJ3W-JWP8-X2G3...

@graphql-mesh/plugin-rate-limit (>=0.2.23-alpha-20230403140649-57714f1dd, <=1.0.0), @graphql-mesh/plugin-snapshot (>=0.1.24-alpha-20230403140649-57714f1dd, <=1.0.0) +13 more potentially affected by CVE-2026-27903 via minimatch (>=8.0.2, <=8.0.4)

minimatch NPM version =8.0.2, =0.2.23-alpha-20230403140649-57714f1dd, =0.1.24-alpha-20230403140649-57714f1dd, =0.15.24-alpha-20230403140649-57714f1dd, =2.0.0-beta.0, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =1.6.0-alpha.9, =1.4.1, =1.4.4 Source cves: CVE-2026-27903...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 02.aula (1.0.0) +55793 more potentially affected by CVE-2026-27904 via minimatch (>=3.0.0, <=3.1.3)

minimatch NPM version =3.0.0, =1.0.1, =1.1.0 - 02.aula 1.0.0 - 0726react 0.1.1 - 08cms 1.0.0 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 -...

10up-toolkit (>=6.0.0-next.0, <=7.0.0-next.1), @0ti.me/ts-test-deps (0.2.0) +6561 more potentially affected by CVE-2026-27904 via minimatch (>=9.0.0, <=9.0.6)

minimatch NPM version =9.0.0, =6.0.0-next.0, =1.1.0-pre.1, =1.4.0, =9.1.0, =1.17.3-testing-284.48.0, =1.0.0, =1.1.6, =0.0.0-alpha.1011313d2aaf, =1.1.3, =1.0.6, =1.0.25 and more Source cves: CVE-2026-27904 Source advisory: OSV:GHSA-23C5-XMQV-RM74...

02strich-markdown (>=1.0.0, <=1.0.2), @0xintuition/slang-cli (>=0.0.1-b, <=0.0.8) +1944 more potentially affected by CVE-2026-27904 via minimatch (>=4.1.1, <=4.2.4)

minimatch NPM version =4.1.1, =1.0.0, =0.0.1-b, =0.5.2, =5.0.2, =2.2.0, =1.1.4, =1.3.1, =1.0.0, =0.0.2-alpha-20220914223128-d706aab, =0.0.2-alpha-20220915073207-1bb0680, =0.0.2-alpha-20220914223128-d706aab, =1.1.8, =1.0.0, =1.5.0 and more Source cves: CVE-2026-27904 Source advisory:...

@aadarshjr/reweb-js (>=1.0.7, <=1.0.17), @acentswap/ace-core-trial (>=10.4.0, <=10.7.0) +898 more potentially affected by CVE-2026-27904 via minimatch (>=5.0.0, <=5.1.7)

minimatch NPM version =5.0.0, =1.0.7, =10.4.0, =9.0.0, =10.0.0, =10.0.0, =10.5.0, =10.4.0, =0.4.13, =2.3.0, =2.3.0, =2.2.1, =2.2.1, =2.2.2 - @aid-on/aidify 0.1.2 and more Source cves: CVE-2026-27904 Source advisory: OSV:GHSA-23C5-XMQV-RM74...

@0x590fab/sdcor2 (>=4.2.1, <=4.4.0), @cenk1cenk2/renovate-config (>=2.2.33, <=2.3.94) +22 more potentially affected by CVE-2026-27904 via minimatch (>=6.0.0, <=6.2.0)

minimatch NPM version =6.0.0, =4.2.1, =2.2.33, =0.2.6-alpha-20230114225627-66f5d9eac, =0.1.7-alpha-20230114225627-66f5d9eac, =0.15.7-alpha-20230114225627-66f5d9eac, =0.1.0, =3.108.8--canary.1.4727068200.0, =0.0.0, =1.12.0, =1.0.0-beta.13, =0.36.6-0, =0.36.6-0, =0.39.3-0 - editorconfig 1.0.2 and...

@graphql-mesh/plugin-rate-limit (>=0.2.23-alpha-20230403140649-57714f1dd, <=1.0.0), @graphql-mesh/plugin-snapshot (>=0.1.24-alpha-20230403140649-57714f1dd, <=1.0.0) +13 more potentially affected by CVE-2026-27904 via minimatch (>=8.0.2, <=8.0.4)

minimatch NPM version =8.0.2, =0.2.23-alpha-20230403140649-57714f1dd, =0.1.24-alpha-20230403140649-57714f1dd, =0.15.24-alpha-20230403140649-57714f1dd, =2.0.0-beta.0, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =0.42.1, =1.6.0-alpha.9, =1.4.1, =1.4.4 Source cves: CVE-2026-27904...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @10xly/eslint-config (>=1.0.0, <=1.0.8) +1203 more potentially affected by CVE-2026-27904 via minimatch (>=10.0.0, <=10.2.2)

minimatch NPM version =10.0.0, =0.0.1, =1.0.0, =6.0.0-test.1, =10.0.0, =10.0.0, =8.0.1, =13.0.0, =5.1.3, =0.2.0, =0.9.2, =0.5.1-alpha.0, =4.10.0, =4.16.0 and more Source cves: CVE-2026-27904 Source advisory: OSV:GHSA-23C5-XMQV-RM74...

@restura/core (>=0.1.0-alpha.12, <=2.4.0), @restura/logger (1.0.1) +42 more potentially affected by CVE-2023-26132 +1 more via dottie (>=2.0.4, <=2.0.6)

dottie NPM version =2.0.4, =0.1.0-alpha.12, =1.3.53, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =1.0.21, =1.0.25, =1.0.25, =1.0.25, =1.3.44, =1.3.53, =1.3.35, =1.6.18 and more Source cves: CVE-2023-26132, CVE-2026-27837 Source advisory: SNYK:JS-DOTTIE-15360180...

5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +4226 more potentially affected by CVE-2026-27942 via fast-xml-parser (>=4.0.0, <=4.5.3)

fast-xml-parser NPM version =4.0.0, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2026-27942 Source advisory: SNYK:JS-FASTXMLPARSER-15353391...

@akash-aw/aw-wizard-forms (4.14.0), @alfresco/aca-generators (>=1.0.0, <=1.0.1) +137 more potentially affected by CVE-2026-27959 via koa (>=3.0.0, <=3.1.1)

koa NPM version =3.0.0, =1.0.0, =1.0.0, =0.44.0, =0.0.0-nightly-20260213031600, =0.0.0-nightly-20260317031259, =0.0.0-nightly-20260317031259, =0.0.0-nightly-20260213031600, =2025.12.1, =2.23.0, =0.0.1, =0.20.0, =0.0.5, =2026.1.2, =2.0.0, =2.0.1 and more Source cves: CVE-2026-27959 Source advisory...

@0x590fab/sdcor2 (>=4.2.1, <=4.4.0), @cenk1cenk2/renovate-config (>=2.2.33, <=2.3.94) +22 more potentially affected by CVE-2026-27903 via minimatch (>=6.0.0, <=6.2.0)

minimatch NPM version =6.0.0, =4.2.1, =2.2.33, =0.2.6-alpha-20230114225627-66f5d9eac, =0.1.7-alpha-20230114225627-66f5d9eac, =0.15.7-alpha-20230114225627-66f5d9eac, =0.1.0, =3.108.8--canary.1.4727068200.0, =0.0.0, =1.12.0, =1.0.0-beta.13, =0.36.6-0, =0.36.6-0, =0.39.3-0 - editorconfig 1.0.2 and...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @10xly/eslint-config (>=1.0.0, <=1.0.8) +1203 more potentially affected by CVE-2026-27904 via minimatch (>=10.0.0, <=10.2.2)

minimatch NPM version =10.0.0, =0.0.1, =1.0.0, =6.0.0-test.1, =10.0.0, =10.0.0, =8.0.1, =13.0.0, =5.1.3, =0.2.0, =0.9.2, =0.5.1-alpha.0, =4.10.0, =4.16.0 and more Source cves: CVE-2026-27904 Source advisory: SNYK:JS-MINIMATCH-15353387...

@lapidist/design-lint (>=6.1.0, <=7.0.1), @markuplint/svelte-parser (>=5.0.0-alpha.0, <=5.0.0-alpha.2) +2 more potentially affected by CVE-2026-27902 via svelte (>=5.53.0, <=5.53.3)

svelte NPM version =5.53.0, =6.1.0, =5.0.0-alpha.0, =5.0.0-alpha.2 - @networkpro/web 1.26.10 - dumbo-svelte 0.3.1 Source cves: CVE-2026-27902 Source advisory: SNYK:JS-SVELTE-15353447...

@cognigy/cognigy-cli (>=1.9.7, <=2.2.7), @forestadmin/agent (>=1.71.0, <=1.72.9) +29 more potentially affected by CVE-2026-27795 via @langchain/community (>=1.0.0, <=1.1.16)

@langchain/community NPM version =1.0.0, =1.9.7, =1.71.0, =1.1.0, =1.12.76, =0.0.1, =0.1.0, =0.2.0, =0.20.0, =0.21.0, =0.0.16, =1.4.13, =1.0.1, =1.0.24, =1.0.26 and more Source cves: CVE-2026-27795 Source advisory: SNYK:JS-LANGCHAINCOMMUNITY-15354988...