5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +3939 more potentially affected by CVE-2026-26278 via fast-xml-parser (>=4.1.3, <=4.5.3)

fast-xml-parser NPM version =4.1.3, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2026-26278 Source advisory: SNYK:JS-FASTXMLPARSER-15307668...

com.codbex.atlas:codbex-atlas-application (>=2.62.0, <=2.126.0), com.codbex.gaia:codbex-gaia-application (>=2.61.0, <=2.111.0) +25 more potentially affected by CVE-2026-26278 via org.webjars.npm:fast-xml-parser (>=4.5.3, <=5.8.0)

org.webjars.npm:fast-xml-parser MAVEN version =4.5.3, =2.62.0, =2.61.0, =2.52.0, =2.52.0, =2.51.0, =2.51.0, =3.6.0, =2.50.0, =5.0.0, =5.0.0, =11.58.0, =12.2.0, =11.58.0, =11.58.0, =14.19.0, =14.40.0 and more Source cves: CVE-2026-26278 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15325721...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1118 more potentially affected by CVE-2026-26278 via fast-xml-parser (>=5.0.1, <=5.3.5)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-26278 Source advisory: SNYK:JS-FASTXMLPARSER-15307668...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1118 more potentially affected by CVE-2026-26278 via fast-xml-parser (>=5.0.1, <=5.3.5)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-26278 Source advisory: OSV:GHSA-JMR7-XGP7-CMFJ...

org.webjars.npm:github-com-aws-amazon-cognito-identity-js (1.12.0) potentially affected by CVE-2026-4258 via org.webjars.npm:sjcl (1.0.8)

org.webjars.npm:sjcl MAVEN version 1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sjcl and may be impacted: - org.webjars.npm:github-com-aws-amazon-cognito-identity-js 1.12.0 Source cves: CVE-2026-4258 Source advisory:...

@0xcurvy/curvy-sdk (0.0.8-rc.1), @acyclic/keythereum (>=1.1.0, <=1.1.2) +456 more potentially affected by CVE-2026-4258 via sjcl (>=1.0.0, <=1.0.8)

sjcl NPM version =1.0.0, =1.1.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.1.5, =9.0.7, =9.0.7, =11.5.2, =11.5.2, =1.0.1, =1.0.7 and more Source cves: CVE-2026-4258 Source advisory: SNYK:JS-SJCL-15369617...

org.webjars.npm:jsrsasign-util (1.0.5) potentially affected by CVE-2026-4599 via org.webjars.npm:jsrsasign (11.1.0)

org.webjars.npm:jsrsasign MAVEN version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:jsrsasign and may be impacted: - org.webjars.npm:jsrsasign-util 1.0.5 Source cves: CVE-2026-4599 Source advisory:...

@0x5e/react-native-alipay (>=0.2.2, <=0.2.7-beta.2), @10yun/cv-mobile-ui (0.3.20) +1792 more potentially affected by CVE-2026-4599 via jsrsasign (>=7.1.2, <=11.1.0)

jsrsasign NPM version =7.1.2, =0.2.2, =0.0.0-alpha.0, =0.7.6, =0.7.6, =0.0.83, =0.7.6, =0.7.6, =0.9.0, =0.7.6, =0.7.6, =0.7.6, =0.3.4, =0.3.4, =0.3.4, =0.8.0 and more Source cves: CVE-2026-4599 Source advisory: SNYK:JS-JSRSASIGN-15370939...

figma-tree (>=0.0.1, <=0.0.11) potentially affected by CVE-2026-2544 via lu2 (2023.9.15)

lu2 NPM version 2023.9.15 is affected by a known vulnerability. The following packages have a transitive dependency on lu2 and may be impacted: - figma-tree =0.0.1, =0.0.11 Source cves: CVE-2026-2544 Source advisory: SNYK:JS-LU2-15285654...

@atomicservice/ascf-toolkit (>=1.0.0, <=1.0.17), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.17) +77 more potentially affected by CVE-2026-4601 via jsrsasign (>=11.0.0, <=11.1.0)

jsrsasign NPM version =11.0.0, =1.0.0, =1.0.1-beta.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.8.3 - @citrineos/ocpi-base 2.0.1 - @citrineos/ocpi-cdrs 2.0.1 - @citrineos/ocpi-charging-profiles 2.0.1 - @citrineos/ocpi-commands 2.0.1 - @citrineos/ocpi-credentials 2.0.1 - @citrineos/ocpi-locations 2.0.1 -...

org.webjars.npm:jsrsasign-util (1.0.5) potentially affected by CVE-2026-4601 via org.webjars.npm:jsrsasign (11.1.0)

org.webjars.npm:jsrsasign MAVEN version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:jsrsasign and may be impacted: - org.webjars.npm:jsrsasign-util 1.0.5 Source cves: CVE-2026-4601 Source advisory:...

org.webjars.npm:jsrsasign-util (1.0.5) potentially affected by CVE-2026-4600 via org.webjars.npm:jsrsasign (11.1.0)

org.webjars.npm:jsrsasign MAVEN version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:jsrsasign and may be impacted: - org.webjars.npm:jsrsasign-util 1.0.5 Source cves: CVE-2026-4600 Source advisory:...

@atomicservice/ascf-toolkit (>=1.0.0, <=1.0.17), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.17) +77 more potentially affected by CVE-2026-4600 via jsrsasign (>=11.0.0, <=11.1.0)

jsrsasign NPM version =11.0.0, =1.0.0, =1.0.1-beta.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.8.3 - @citrineos/ocpi-base 2.0.1 - @citrineos/ocpi-cdrs 2.0.1 - @citrineos/ocpi-charging-profiles 2.0.1 - @citrineos/ocpi-commands 2.0.1 - @citrineos/ocpi-credentials 2.0.1 - @citrineos/ocpi-locations 2.0.1 -...

mindsdb-server (>=0.9.1, <=1.2.2) potentially affected by CVE-2026-2531 via mindsdb (26.1.0)

mindsdb PYPI version 26.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on mindsdb and may be impacted: - mindsdb-server =0.9.1, =1.2.2 Source cves: CVE-2026-2531 Source advisory: SNYK:PYTHON-MINDSDB-15285619...

@agishub/mcp (>=2.1.0, <=2.1.2), @anngdinh/remote-mcp-server-authless (0.0.0) +117 more potentially affected by unknown CVE via agents (>=0.0.43, <=0.2.35)

agents NPM version =0.0.43, =2.1.0, =0.4.0, =1.1.1, =0.2.0, =0.1.0, =0.0.1, =1.0.1, =0.2.0, =0.5.3 and more Source cves: unknown CVE Source advisory: SNYK:JS-AGENTS-15282793...

@agishub/mcp (>=2.1.0, <=2.1.2), @anngdinh/remote-mcp-server-authless (0.0.0) +117 more potentially affected by unknown CVE via agents (>=0.0.43, <=0.2.35)

agents NPM version =0.0.43, =2.1.0, =0.4.0, =1.1.1, =0.2.0, =0.1.0, =0.0.1, =1.0.1, =0.2.0, =0.5.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W5CR-2QHR-JQC5...

@jamietanna/renovate-graph (0.36.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (3.1.1) potentially affected by unknown CVE via renovate (>=42.92.4, <=42.92.5)

renovate NPM version =42.92.4, =42.92.5 is affected by a known vulnerability. The following packages have a transitive dependency on renovate and may be impacted: - @jamietanna/renovate-graph 0.36.0 - @secustor/backstage-plugin-renovate-backend-module-runtime-direct 3.1.1 Source cves: unknown CVE...

@jamietanna/renovate-graph (0.36.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (3.1.1) potentially affected by CVE-2026-76227 via renovate (>=42.92.4, <=42.92.5)

renovate NPM version =42.92.4, =42.92.5 is affected by a known vulnerability. The following packages have a transitive dependency on renovate and may be impacted: - @jamietanna/renovate-graph 0.36.0 - @secustor/backstage-plugin-renovate-backend-module-runtime-direct 3.1.1 Source cves:...

hpke-rs (>=0.1.0-pre.1, <=0.1.0-pre.2), openmls (>=0.4.0-pre.1, <=0.4.0-pre.2) +2 more potentially affected by unknown CVE via hpke-rs-rust-crypto (0.1.1)

hpke-rs-rust-crypto CARGO version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on hpke-rs-rust-crypto and may be impacted: - hpke-rs =0.1.0-pre.1, =0.4.0-pre.1, =0.1.0-pre.1, =0.3.0, =0.9.0 Source cves: unknown CVE Source advisory:...

openmls (>=0.4.0-pre.1, <=0.4.0-pre.2), openmls_evercrypt (>=0.1.0-pre.1, <=0.1.0-pre.2) +2 more potentially affected by unknown CVE via hpke-rs (0.1.2)

hpke-rs CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on hpke-rs and may be impacted: - openmls =0.4.0-pre.1, =0.1.0-pre.1, =0.1.0-pre.1, =0.3.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:GHSA-G433-PQ76-6CMF...

@agishub/mcp (>=2.1.0, <=2.1.2), @anngdinh/remote-mcp-server-authless (0.0.0) +117 more potentially affected by CVE-2026-1721 via agents (>=0.0.43, <=0.2.35)

agents NPM version =0.0.43, =2.1.0, =0.4.0, =1.1.1, =0.2.0, =0.1.0, =0.0.1, =1.0.1, =0.2.0, =0.5.3 and more Source cves: CVE-2026-1721 Source advisory: OSV:GHSA-CVHV-6XM6-C3V4...

@agishub/mcp (>=2.1.0, <=2.1.2), @anngdinh/remote-mcp-server-authless (0.0.0) +117 more potentially affected by CVE-2026-1721 via agents (>=0.0.43, <=0.2.35)

agents NPM version =0.0.43, =2.1.0, =0.4.0, =1.1.1, =0.2.0, =0.1.0, =0.0.1, =1.0.1, =0.2.0, =0.5.3 and more Source cves: CVE-2026-1721 Source advisory: SNYK:JS-AGENTS-15279200...

@bicou/directus-extension-imagga (>=1.6.3, <=1.6.6), @devix-tecnologia/utils-ts (1.0.0) +2 more potentially affected by CVE-2026-26185 via directus (>=11.0.0, <=11.14.0)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =32.2.0 - @fahami/directus-pkce 1.0.0 Source cves: CVE-2026-26185 Source advisory: OSV:GHSA-JR94-GJ3H-C8RF...

directus (>=11.13.0, <=11.13.4) potentially affected by CVE-2026-26185 via @directus/api (>=32.0.0, <=32.1.1)

@directus/api NPM version =32.0.0, =11.13.0, =11.13.4 Source cves: CVE-2026-26185 Source advisory: OSV:GHSA-JR94-GJ3H-C8RF...

libcrux-kem (>=0.0.2-alpha.1, <=0.0.2), libcrux-psq (0.0.2-beta.3) potentially affected by CVE-2026-76234 via libcrux-ecdh (0.0.2-beta.3)

libcrux-ecdh CARGO version 0.0.2-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ecdh and may be impacted: - libcrux-kem =0.0.2-alpha.1, =0.0.2 - libcrux-psq 0.0.2-beta.3 Source cves: CVE-2026-76234 Source advisory: OSV:GHSA-435G-FCV3-8J...

modern-web-swiss-army-knife (>=2.7.0, <=2.7.2) potentially affected by CVE-2025-56647 via @farmfe/core (1.6.6)

@farmfe/core NPM version 1.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on @farmfe/core and may be impacted: - modern-web-swiss-army-knife =2.7.0, =2.7.2 Source cves: CVE-2025-56647 Source advisory: OSV:GHSA-P773-8MF4-RJM5...

1k-utils (>=2.1.0, <=2.2.3), 20190403-utils (1.0.0) +13347 more potentially affected by CVE-2026-2391 +1 more via qs (>=6.7.0, <=6.14.1)

qs NPM version =6.7.0, =2.1.0, =2.0.0, =1.0.0, =0.0.28, =1.0.8, =4.11.0, =2.0.1, =0.0.1, =3.10.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-2391, CVE-2026-82562 Source advisory: OSV:GHSA-W7FW-MJWX-W883...

modern-web-swiss-army-knife (>=2.7.0, <=2.7.2) potentially affected by CVE-2025-56647 via @farmfe/core (1.6.6)

@farmfe/core NPM version 1.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on @farmfe/core and may be impacted: - modern-web-swiss-army-knife =2.7.0, =2.7.2 Source cves: CVE-2025-56647 Source advisory: SNYK:JS-FARMFECORE-15282805...

11ty-nunjucks-md (1.0.0), 20ful (>=0.3.2, <=0.3.5) +2730 more potentially affected by CVE-2026-2327 via markdown-it (>=13.0.0, <=14.1.0)

markdown-it NPM version =13.0.0, =0.3.2, =0.0.2, =2.0.0-beta.1, =0.3.1, =0.42.46, =2.0.4, =0.0.1, =0.33.4, =0.3.0, =10.22.0, =3.7.0-beta.1, =3.9.3 and more Source cves: CVE-2026-2327 Source advisory: OSV:GHSA-38C4-R59V-3VQW...

1k-utils (>=2.1.0, <=2.2.3), 20190403-utils (1.0.0) +13347 more potentially affected by CVE-2026-2391 via qs (>=6.7.0, <=6.14.1)

qs NPM version =6.7.0, =2.1.0, =2.0.0, =1.0.0, =0.0.28, =1.0.8, =4.11.0, =2.0.1, =0.0.1, =3.10.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-2391 Source advisory: SNYK:JS-QS-15268416...

@aliceoq/library-test (>=1.3.2, <=1.3.3), @bentwnghk/chat (>=1.61.0, <=1.107.2) +169 more potentially affected by CVE-2026-0969 via next-mdx-remote (>=4.4.1, <=5.0.0)

next-mdx-remote NPM version =4.4.1, =1.3.2, =1.61.0, =1.1.1, =1.109.0, =0.0.2, =1.0.0, =0.1.1, =0.0.1, =2.13.2, =0.0.3, =0.2.0, =0.1.0, =0.5.0, =0.6.0 and more Source cves: CVE-2026-0969 Source advisory: OSV:GHSA-G4XW-JXRG-5F6M...

@aliceoq/library-test (>=1.3.2, <=1.3.3), @bentwnghk/chat (>=1.61.0, <=1.107.2) +169 more potentially affected by CVE-2026-0969 via next-mdx-remote (>=4.4.1, <=5.0.0)

next-mdx-remote NPM version =4.4.1, =1.3.2, =1.61.0, =1.1.1, =1.109.0, =0.0.2, =1.0.0, =0.1.1, =0.0.1, =2.13.2, =0.0.3, =0.2.0, =0.1.0, =0.5.0, =0.6.0 and more Source cves: CVE-2026-0969 Source advisory: SNYK:JS-NEXTMDXREMOTE-15282839...

@cognigy/cognigy-cli (>=1.9.7, <=2.1.0), @forestadmin/agent (>=1.71.0, <=1.72.9) +13 more potentially affected by CVE-2026-26019 via @langchain/community (>=1.0.0, <=1.1.12)

@langchain/community NPM version =1.0.0, =1.9.7, =1.71.0, =1.1.0, =1.12.76, =0.0.1, =0.2.0, =0.0.16, =1.4.13, =1.0.24, =1.0.0, =3.1.0, =0.3.0, =0.0.210, =0.1.1, =0.1.2 Source cves: CVE-2026-26019 Source advisory: SNYK:JS-LANGCHAINCOMMUNITY-15268428...

@0xlimao/n8n-nodes-ethereum (0.1.1), @advenimuss/n8n-nodes-msgraph (>=0.1.0, <=0.2.1) +356 more potentially affected by CVE-2026-26019 via @langchain/core (>=1.0.1, <=1.1.13)

@langchain/core NPM version =1.0.1, =0.1.0, =1.0.0, =1.2.1, =1.2.2, =1.2.2, =2.2.2, =2.2.2, =2.2.2, =2.1.9, =2.1.0, =2.1.0, =2.1.26 and more Source cves: CVE-2026-26019 Source advisory: SNYK:JS-LANGCHAINCORE-15268429...

1-sep-ui (>=0.0.1, <=0.0.2), 3d-crystal-model (0.1.0) +7232 more potentially affected by CVE-2025-69873 via ajv (>=6.0.0, <=6.12.6)

ajv NPM version =6.0.0, =0.0.1, =1.0.23, =0.0.1, =1.0.0, =1.0.0, =6.0.0, =0.0.2, =1.0.0, =0.0.10, =0.0.3, =1.0.6, =2.2.0 and more Source cves: CVE-2025-69873 Source advisory: OSV:GHSA-2G4F-4PWH-QVX6...

0.edsql (>=1.0.49, <=1.0.50), 360-lib (1.0.0) +10523 more potentially affected by CVE-2025-69873 via ajv (>=7.0.0, <=8.17.1)

ajv NPM version =7.0.0, =1.0.49, =10.0.2-0, =4.11.2, =0.1.0, =0.1.1, =0.0.1-251008.90016, =0.3.0-rc.3, =1.0.0, =1.4.0, =1.0.0, =0.0.2, =2.0.0, =3.0.0 and more Source cves: CVE-2025-69873 Source advisory: OSV:GHSA-2G4F-4PWH-QVX6...

@bloggrify/bento (>=0.9.5, <=1.0.0), @bloggrify/core (>=1.6.0, <=2.0.2) +29 more potentially affected by CVE-2025-69874 via nanotar (0.1.1)

nanotar NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on nanotar and may be impacted: - @bloggrify/bento =0.9.5, =1.6.0, =1.3.1, =1.2.2, =0.1.2, =51.0.1, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =0.0.0, =1.1.1, =0.50.0-beta.11,...

3thfloor (>=0.1.0, <=0.1.3), a-simple-llm-kit (>=0.3.0, <=0.4.2) +3711 more potentially affected by CVE-2025-69872 via diskcache (>=2.4.1, <=5.6.3)

diskcache PYPI version =2.4.1, =0.1.0, =0.3.0, =0.9.2, =0.1.0, =0.2.1, =0.1.1.dev1, =0.1.0, =0.1.0, =0.3.4, =0.1.1, =0.3.3, =0.1.32, =0.1.35 and more Source cves: CVE-2025-69872 Source advisory: SNYK:PYTHON-DISKCACHE-15268422...

@bloggrify/bento (>=0.9.5, <=1.0.0), @bloggrify/core (>=1.6.0, <=2.0.2) +29 more potentially affected by CVE-2025-69874 via nanotar (0.1.1)

nanotar NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on nanotar and may be impacted: - @bloggrify/bento =0.9.5, =1.6.0, =1.3.1, =1.2.2, =0.1.2, =51.0.1, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =0.0.0, =1.1.1, =0.50.0-beta.11,...

@cognigy/cognigy-cli (>=1.9.7, <=2.1.0), @forestadmin/agent (>=1.71.0, <=1.72.9) +13 more potentially affected by CVE-2026-26019 +1 more via @langchain/community (>=1.0.0, <=1.1.12)

@langchain/community NPM version =1.0.0, =1.9.7, =1.71.0, =1.1.0, =1.12.76, =0.0.1, =0.2.0, =0.0.16, =1.4.13, =1.0.24, =1.0.0, =3.1.0, =0.3.0, =0.0.210, =0.1.1, =0.1.2 Source cves: CVE-2026-26019, CVE-2026-27795 Source advisory: OSV:GHSA-GF3V-FWQG-4VH7...

openmls (>=0.4.0-pre.1, <=0.4.0-pre.2), openmls_evercrypt (>=0.1.0-pre.1, <=0.1.0-pre.2) +2 more potentially affected by unknown CVE via hpke-rs (0.1.2)

hpke-rs CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on hpke-rs and may be impacted: - openmls =0.4.0-pre.1, =0.1.0-pre.1, =0.1.0-pre.1, =0.3.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0069...

openmls (>=0.4.0-pre.1, <=0.4.0-pre.2), openmls_evercrypt (>=0.1.0-pre.1, <=0.1.0-pre.2) +2 more potentially affected by unknown CVE via hpke-rs (0.1.2)

hpke-rs CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on hpke-rs and may be impacted: - openmls =0.4.0-pre.1, =0.1.0-pre.1, =0.1.0-pre.1, =0.3.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0070...

1-sep-ui (>=0.0.1, <=0.0.2), 3d-crystal-model (0.1.0) +7232 more potentially affected by CVE-2025-69873 via ajv (>=6.0.0, <=6.12.6)

ajv NPM version =6.0.0, =0.0.1, =1.0.23, =0.0.1, =1.0.0, =1.0.0, =6.0.0, =0.0.2, =1.0.0, =0.0.10, =0.0.3, =1.0.6, =2.2.0 and more Source cves: CVE-2025-69873 Source advisory: SNYK:JS-AJV-15274295...

0.edsql (>=1.0.49, <=1.0.50), 360-lib (1.0.0) +10523 more potentially affected by CVE-2025-69873 via ajv (>=7.0.0, <=8.17.1)

ajv NPM version =7.0.0, =1.0.49, =10.0.2-0, =4.11.2, =0.1.0, =0.1.1, =0.0.1-251008.90016, =0.3.0-rc.3, =1.0.0, =1.4.0, =1.0.0, =0.0.2, =2.0.0, =3.0.0 and more Source cves: CVE-2025-69873 Source advisory: SNYK:JS-AJV-15274295...

@abip/scp-common (1.0.1-alpha.0), @aftership/automizely-rbac-react (>=0.1.0, <=0.6.1) +402 more potentially affected by CVE-2026-1774 via @casl/ability (>=2.4.2, <=6.7.3)

@casl/ability NPM version =2.4.2, =0.1.0, =3.7.0, =0.2.0, =0.3.1, =4.25.19-patch.1, =0.0.1, =0.0.1, =0.1.0, =1.7.0, =2.16.10 and more Source cves: CVE-2026-1774 Source advisory: OSV:GHSA-X9VF-53Q3-CVX6...

@abip/scp-common (1.0.1-alpha.0), @aftership/automizely-rbac-react (>=0.1.0, <=0.6.1) +402 more potentially affected by CVE-2026-1774 via @casl/ability (>=2.4.2, <=6.7.3)

@casl/ability NPM version =2.4.2, =0.1.0, =3.7.0, =0.2.0, =0.3.1, =4.25.19-patch.1, =0.0.1, =0.0.1, =0.1.0, =1.7.0, =2.16.10 and more Source cves: CVE-2026-1774 Source advisory: SNYK:JS-CASLABILITY-15268419...

@cubejs-backend/server (>=1.1.17, <=1.4.1), @cubejs-backend/testing-drivers (>=1.1.17, <=1.4.1) potentially affected by CVE-2026-25957 via @cubejs-backend/server-core (>=1.1.17, <=1.4.1)

@cubejs-backend/server-core NPM version =1.1.17, =1.1.17, =1.1.17, =1.4.1 Source cves: CVE-2026-25957 Source advisory: OSV:GHSA-9VPH-2HVM-X66G...

@cubejs-backend/server (>=1.5.0, <=1.5.12), @cubejs-backend/testing-drivers (>=1.5.0, <=1.5.12) potentially affected by CVE-2026-25957 via @cubejs-backend/server-core (>=1.5.0, <=1.5.12)

@cubejs-backend/server-core NPM version =1.5.0, =1.5.0, =1.5.0, =1.5.12 Source cves: CVE-2026-25957 Source advisory: OSV:GHSA-9VPH-2HVM-X66G...

@cubejs-backend-json-clone/server (1.0.0), @cubejs-backend/server (>=0.27.0, <=1.0.13) +4 more potentially affected by CVE-2026-25958 via @cubejs-backend/server-core (>=0.27.53, <=1.0.13)

@cubejs-backend/server-core NPM version =0.27.53, =0.27.0, =0.27.0, =0.27.0, =0.27.0, =0.32.28, =1.0.13 Source cves: CVE-2026-25958 Source advisory: OSV:GHSA-V226-32C7-X2V7...

@cubejs-backend/server (>=1.1.0, <=1.4.1), @cubejs-backend/testing-drivers (>=1.1.0, <=1.4.1) potentially affected by CVE-2026-25958 via @cubejs-backend/server-core (>=1.1.0, <=1.4.1)

@cubejs-backend/server-core NPM version =1.1.0, =1.1.0, =1.1.0, =1.4.1 Source cves: CVE-2026-25958 Source advisory: OSV:GHSA-V226-32C7-X2V7...