@directus/release-notes-generator (>=2.0.2, <=3.0.0), @eclipse-scout/releng (>=26.2.0, <=26.2.1) +107 more potentially affected by CVE-2026-23889 via @pnpm/store.cafs (>=1000.0.0, <=1000.1.1)

@pnpm/store.cafs NPM version =1000.0.0, =2.0.2, =26.2.0, =0.1.0-beta.0, =4.0.0, =2.0.1, =1000.3.2, =1000.0.0, =1000.0.0, =1000.1.1, =1000.1.0, =1000.0.1, =1000.0.28 and more Source cves: CVE-2026-23889 Source advisory: SNYK:JS-PNPMSTORECAFS-15116159...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +9 more potentially affected by CVE-2026-23889 via pnpm (>=10.0.0, <=10.18.3)

pnpm NPM version =10.0.0, =0.1.0, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-23889 Source advisory: OSV:GHSA-6X96-7VC8-CM3P...

@directus/release-notes-generator (>=2.0.2, <=3.0.0), @eclipse-scout/releng (>=26.2.0, <=26.2.1) +78 more potentially affected by CVE-2026-23890 via @pnpm/package-bins (>=1000.0.0, <=1000.0.15)

@pnpm/package-bins NPM version =1000.0.0, =2.0.2, =26.2.0, =0.1.0-beta.0, =1000.3.2, =1000.0.21, =1000.1.1, =1000.0.0, =1007.0.1, =1002.2.0, =1002.2.23 - @pnpm/deps.compliance.commands 1000.0.0 and more Source cves: CVE-2026-23890 Source advisory: SNYK:JS-PNPMPACKAGEBINS-15103738...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +9 more potentially affected by CVE-2026-23890 via pnpm (>=10.0.0, <=10.18.3)

pnpm NPM version =10.0.0, =0.1.0, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-23890 Source advisory: OSV:GHSA-XPQM-WM3M-F34H...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +9 more potentially affected by CVE-2026-24056 via pnpm (>=10.0.0, <=10.18.3)

pnpm NPM version =10.0.0, =0.1.0, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-24056 Source advisory: OSV:GHSA-M733-5W8F-5GGW...

@directus/release-notes-generator (>=2.0.2, <=3.0.0), @eclipse-scout/releng (>=26.2.0, <=26.2.1) +107 more potentially affected by CVE-2026-24056 via @pnpm/store.cafs (>=1000.0.0, <=1000.1.2)

@pnpm/store.cafs NPM version =1000.0.0, =2.0.2, =26.2.0, =0.1.0-beta.0, =4.0.0, =2.0.1, =1000.3.2, =1000.0.0, =1000.0.0, =1000.1.1, =1000.1.0, =1000.0.1, =1000.1.0 and more Source cves: CVE-2026-24056 Source advisory: SNYK:JS-PNPMSTORECAFS-15116208...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +302 more potentially affected by CVE-2025-55184 +1 more via next (>=15.3.0, <=15.3.8)

next NPM version =15.3.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.1.0, =0.0.5-alpha-20250409222818-a35bb677fde1e4e9cf3db443e9ae36abf4f8e21b, =0.0.20, =0.0.22 - @aeon-ai-pay/x402-axios 0.0.1 - @aeon-ai-pay/x402-hono 0.0.3 - @affrawidy/wawok 1.1.4 - @agogic/business-data 0.0.2 and more Source cves:...

3llm (0.0.1), @3bitmt/3bit-sidebar-dashboard (1.1.4) +306 more potentially affected by CVE-2025-55184 +1 more via next (>=15.1.0, <=15.1.11)

next NPM version =15.1.0, =0.0.3-alpha-20241210234548-01b7322d940b7c913e95222127be2373f0f996cf, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.1, =0.1.1, =0.1.0, =0.1.22 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2025-55184 +1 more via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.0.4, =2.0.3-next.0 an...

47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +210 more potentially affected by CVE-2025-55184 +1 more via next (>=15.5.0, <=15.5.9)

next NPM version =15.5.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...

@4399ywkf/router (>=0.0.1, <=0.0.4), @akash-aw/aw-wizard-forms (4.14.0) +138 more potentially affected by CVE-2025-55184 +1 more via @modern-js/utils (>=2.65.2, <=2.70.4)

@modern-js/utils NPM version =2.65.2, =0.0.1, =1.0.0, =1.0.0, =0.44.0, =2.23.0, =0.3.53, =0.0.0-beta.1, =1.0.1, =0.30.0, =0.39.0 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-MODERNJSUTILS-15120607...

@adenta/cms (>=0.0.6, <=1.1.1-0), @alisonquinter17/alieta-ui (0.1.0) +131 more potentially affected by CVE-2025-55184 +1 more via next (>=15.4.0-canary.17, <=15.4.10)

next NPM version =15.4.0-canary.17, =0.0.6, =0.1.0, =0.1.0, =0.1.0, =1.2.4-main.7f918ee.29, =0.2.0, =1.0.0, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.4, =0.0.1, =0.0.3 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...

9remote (>=0.1.0, <=0.1.8), @alecpapierniak/mcp-manager (>=0.1.0, <=0.1.2) +119 more potentially affected by CVE-2025-55184 +1 more via next (>=16.1.0, <=16.1.4)

next NPM version =16.1.0, =0.1.0, =0.1.0, =0.0.6, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =1.0.8, =1.0.9 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...

@071yoon/log-console-core (0.1.0), @3bitmt/3bit-sidebar-dashboard (1.2.0) +209 more potentially affected by CVE-2025-55184 +1 more via next (>=16.0.0, <=16.0.10)

next NPM version =16.0.0, =1.0.0, =0.3.128, =1.0.0-canary.3, =0.1.0, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.1.0, =1.0.4186, =1.0.4144, =1.0.4257, =1.0.4556 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory:...

@cedarjs/api-server (>=1.0.0-canary.12863, <=3.0.0-canary.13332), @cedarjs/cli (>=1.0.0-canary.12863, <=3.0.0-canary.13332) +13 more potentially affected by CVE-2025-55184 +1 more via react-server-dom-webpack (>=19.2.0-canary-cee7939b-20250625, <=19.2.3)

react-server-dom-webpack NPM version =19.2.0-canary-cee7939b-20250625, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...

@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +212 more potentially affected by CVE-2025-55184 +1 more via next (>=15.2.0, <=15.2.8)

next NPM version =15.2.0, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: CVE-2025-55184, CVE-2026-238...

org.webjars.npm:degenerator (4.0.4), org.webjars.npm:pac-resolver (6.0.2) +1 more potentially affected by CVE-2026-22709 via org.webjars.npm:vm2 (3.9.19)

org.webjars.npm:vm2 MAVEN version 3.9.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:vm2 and may be impacted: - org.webjars.npm:degenerator 4.0.4 - org.webjars.npm:pac-resolver 6.0.2 - org.webjars.npm:rocket.chatapps-engine 1.35.0...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +281 more potentially affected by CVE-2026-22709 via vm2 (>=3.0.0, <=3.10.1)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +281 more potentially affected by CVE-2026-22709 via vm2 (>=3.0.0, <=3.10.1)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@runhalodev/cli (>=0.0.1, <=0.0.3), nearai-cloud-verifier (0.0.1-alpha.1) potentially affected by CVE-2026-22696 via @phala/dcap-qvl-node (0.3.3)

@phala/dcap-qvl-node NPM version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on @phala/dcap-qvl-node and may be impacted: - @runhalodev/cli =0.0.1, =0.0.3 - nearai-cloud-verifier 0.0.1-alpha.1 Source cves: CVE-2026-22696 Source advisory:...

@1upmonster/duel (>=0.1.0, <=0.1.8), @flash_trade/magic-trade-client (>=0.1.0, <=1.0.51) +8 more potentially affected by CVE-2026-22696 via @phala/dcap-qvl-web (>=0.2.7, <=0.3.3)

@phala/dcap-qvl-web NPM version =0.2.7, =0.1.0, =0.1.0, =0.3.6, =0.2.9, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-22696 Source advisory: OSV:GHSA-796P-J2GH-9M2Q...

@0x57/pierre (>=0.0.3, <=0.0.16), @0xshogun/sdk (>=1.1.44, <=1.1.52) +457 more potentially affected by CVE-2025-50537 via eslint (>=9.0.0, <=9.25.1)

eslint NPM version =9.0.0, =0.0.3, =1.1.44, =1.1.14, =0.0.1-alpha.3, =2.4.7, =2.2.5, =0.0.2, =0.0.0-dev-20250424035410, =1.0.68, =0.0.1, =0.0.66, =0.0.3, =1.0.0, =1.0.0, =1.0.2 and more Source cves: CVE-2025-50537 Source advisory: SNYK:JS-ESLINT-15102420...

libcrux-kem (>=0.0.2-alpha.1, <=0.0.2), libcrux-psq (0.0.2-beta.3) potentially affected by unknown CVE via libcrux-ecdh (0.0.2-beta.3)

libcrux-ecdh CARGO version 0.0.2-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ecdh and may be impacted: - libcrux-kem =0.0.2-alpha.1, =0.0.2 - libcrux-psq 0.0.2-beta.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0023...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +28 more potentially affected by CVE-2026-0768 via lfx (>=0.1.13, <=1.12.0.dev22)

lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =1.8.0rc0, =0.7.0, =0.1.0, =0.1.0, =0.1.1rc0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1rc0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-0768 Source advisory: SNYK:PYTHON-LFX-15091578...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +28 more potentially affected by CVE-2026-0771 via lfx (>=0.1.13, <=1.12.0.dev22)

lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =1.8.0rc0, =0.7.0, =0.1.0, =0.1.0, =0.1.1rc0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1rc0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-0771 Source advisory: SNYK:PYTHON-LFX-15091580...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +1 more potentially affected by CVE-2026-0772 via langflow-base (>=0.7.2, <=0.11.3rc0)

langflow-base PYPI version =0.7.2, =1.10.0, =1.8.0rc0, =1.8.0rc2 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-0772 Source advisory: SNYK:PYTHON-LANGFLOWBASE-15091577...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +28 more potentially affected by CVE-2026-0769 via lfx (>=0.1.13, <=1.12.0.dev22)

lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =1.8.0rc0, =0.7.0, =0.1.0, =0.1.0, =0.1.1rc0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1rc0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-0769 Source advisory: SNYK:PYTHON-LFX-15091581...

d2m-apigen (>=1.0.1, <=2.1.7), dm-apigen (>=0.0.0, <=1.0.0) +3 more potentially affected by CVE-2026-24132 via @orval/mock (>=7.0.0, <=7.19.0)

@orval/mock NPM version =7.0.0, =1.0.1, =0.0.0, =1.2.0, =7.0.0, =7.1.0, =7.13.2 Source cves: CVE-2026-24132 Source advisory: SNYK:JS-ORVALMOCK-15091570...

orval (>=8.0.0-rc.0, <=8.0.2) potentially affected by CVE-2026-24132 via @orval/mock (>=8.0.0, <=8.0.2)

@orval/mock NPM version =8.0.0, =8.0.0-rc.0, =8.0.2 Source cves: CVE-2026-24132 Source advisory: SNYK:JS-ORVALMOCK-15091570...

orval (>=8.0.0-rc.0, <=8.0.2) potentially affected by CVE-2026-24132 via @orval/mock (>=8.0.0, <=8.0.2)

@orval/mock NPM version =8.0.0, =8.0.0-rc.0, =8.0.2 Source cves: CVE-2026-24132 Source advisory: OSV:GHSA-F456-RF33-4626...

d2m-apigen (>=1.0.1, <=2.1.7), dm-apigen (>=0.0.0, <=1.0.0) +3 more potentially affected by CVE-2026-24132 via @orval/mock (>=7.0.0, <=7.19.0)

@orval/mock NPM version =7.0.0, =1.0.1, =0.0.0, =1.2.0, =7.0.0, =7.1.0, =7.13.2 Source cves: CVE-2026-24132 Source advisory: OSV:GHSA-F456-RF33-4626...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-qofeno/agentx-cli (>=1.20.47, <=1.20.52) +121 more potentially affected by CVE-2026-24006 via seroval (>=1.0.7, <=1.3.2)

seroval NPM version =1.0.7, =0.2.5, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =0.3.2 - @entropy-tamer/reynard-config 0.1.2 - @entropy-tamer/reynard-i18n 1.2.0 - @entropy-tamer/reynard-validation 0.2.0 and more Source cves: CVE-2026-24006 Source advisory:...

@typebot.io/nextjs (>=0.3.23, <=0.6.0), @typebot.io/react (>=0.3.23, <=0.9.14) potentially affected by CVE-2025-65098 via @typebot.io/js (>=0.3.23, <=0.9.14)

@typebot.io/js NPM version =0.3.23, =0.3.23, =0.3.23, =0.9.14 Source cves: CVE-2025-65098 Source advisory: OSV:GHSA-4XC5-WFWC-JW47...

@typebot.io/nextjs (>=0.3.23, <=0.6.0), @typebot.io/react (>=0.3.23, <=0.9.14) potentially affected by CVE-2025-65098 via @typebot.io/js (>=0.3.23, <=0.9.14)

@typebot.io/js NPM version =0.3.23, =0.3.23, =0.3.23, =0.9.14 Source cves: CVE-2025-65098 Source advisory: SNYK:JS-TYPEBOTIOJS-15060538...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-24006 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-24006 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054528...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-qofeno/agentx-cli (>=1.20.47, <=1.20.52) +121 more potentially affected by CVE-2026-24006 via seroval (>=1.0.7, <=1.3.2)

seroval NPM version =1.0.7, =0.2.5, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =0.3.2 - @entropy-tamer/reynard-config 0.1.2 - @entropy-tamer/reynard-i18n 1.2.0 - @entropy-tamer/reynard-validation 0.2.0 and more Source cves: CVE-2026-24006 Source advisory:...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +4508 more potentially affected by CVE-2025-13465 +1 more via lodash-es (>=4.0.0, <=4.17.22)

lodash-es NPM version =4.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1-alpha.23, =1.0.0, =2.14.1, =41.3.1, =2.1.0, =0.7.0, =1.0.0, =0.1.3, =0.0.4, =0.1.0, =0.0.1-alpha.4, =1.0.1, =1.0.23 and more Source cves: CVE-2025-13465, CVE-2026-2950 Source advisory: OSV:GHSA-XXJR-MMJV-4GPG...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +4508 more potentially affected by CVE-2025-13465 via lodash-es (>=4.0.0, <=4.17.22)

lodash-es NPM version =4.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1-alpha.23, =1.0.0, =2.14.1, =41.3.1, =2.1.0, =0.7.0, =1.0.0, =0.1.3, =0.0.4, =0.1.0, =0.0.1-alpha.4, =1.0.1, =1.0.23 and more Source cves: CVE-2025-13465 Source advisory: SNYK:JS-LODASHES-15053836...

@dojo/cli-test-intern (>=0.1.0, <=2.0.0-beta3.1), express_mvc (>=4.1.1, <=4.3.10) +7 more potentially affected by CVE-2025-13465 via lodash-amd (4.16.4)

lodash-amd NPM version 4.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on lodash-amd and may be impacted: - @dojo/cli-test-intern =0.1.0, =4.1.1, =3.4.0, =0.0.1, =1.0.14, =0.0.7, =0.0.1, =0.1.5 - xirtam--matrix-operations 0.1.3 Source cves:...

-fides-amor-et-lux (1.0.0), 0.electron.main (>=1.0.49, <=1.0.50) +37316 more potentially affected by CVE-2025-13465 +1 more via lodash (>=4.0.0, <=4.17.21)

lodash NPM version =4.0.0, =1.0.49, =1.0.0, =0.0.1, =2.3.0, =1.0.0, =1.0.0, =0.0.2, =0.1.1, =1.0.0, =1.0.0, =1.1.4 - 218-tapp-admin 1.0.0 and more Source cves: CVE-2025-13465, CVE-2026-2950 Source advisory: OSV:GHSA-XXJR-MMJV-4GPG...

@aaronuu/react-forms (>=0.0.1, <=0.2.2), @actra-development-oss/redux-persist-transform-filter-immutable (>=0.1.1, <=1.0.0) +777 more potentially affected by CVE-2025-13465 via lodash.unset (>=4.0.2, <=4.18.0)

lodash.unset NPM version =4.0.2, =0.0.1, =0.1.1, =0.1.0, =0.0.1, =1.1.0, =0.0.4, =1.8.28, =1.1.0, =0.1.2, =0.0.1, =0.1.0, =0.0.1, =2.1.1 and more Source cves: CVE-2025-13465 Source advisory: SNYK:JS-LODASHUNSET-15053837...

-fides-amor-et-lux (1.0.0), 0.electron.main (>=1.0.49, <=1.0.50) +37316 more potentially affected by CVE-2025-13465 via lodash (>=4.0.0, <=4.17.21)

lodash NPM version =4.0.0, =1.0.49, =1.0.0, =0.0.1, =2.3.0, =1.0.0, =1.0.0, =0.0.2, =0.1.1, =1.0.0, =1.0.0, =1.1.4 - 218-tapp-admin 1.0.0 and more Source cves: CVE-2025-13465 Source advisory: SNYK:JS-LODASH-15053838...

@akashic/akashic-cli (>=2.16.49, <=2.17.21), @akashic/akashic-cli-export (>=1.8.28, <=1.9.17) +253 more potentially affected by CVE-2025-13465 +1 more via lodash.unset (>=4.0.2, <=4.5.2)

lodash.unset NPM version =4.0.2, =2.16.49, =1.8.28, =1.2.1, =1.8.4, =8.0.0, =1.0.75, =0.0.2, =0.1.0, =1.31.9, =0.0.4, =0.6.0 and more Source cves: CVE-2025-13465, CVE-2026-2950 Source advisory: OSV:GHSA-XXJR-MMJV-4GPG...

@dojo/cli-test-intern (>=0.1.0, <=2.0.0-beta3.1), express_mvc (>=4.1.1, <=4.3.10) +7 more potentially affected by CVE-2025-13465 +1 more via lodash-amd (4.16.4)

lodash-amd NPM version 4.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on lodash-amd and may be impacted: - @dojo/cli-test-intern =0.1.0, =4.1.1, =3.4.0, =0.0.1, =1.0.14, =0.0.7, =0.0.1, =0.1.5 - xirtam--matrix-operations 0.1.3 Source cves:...

@astrojs/cloudflare (0.4.0), @bookinghub/widget (>=0.1.0, <=0.4.0) +29 more potentially affected by CVE-2026-0933 via wrangler (>=2.0.23, <=3.114.1)

wrangler NPM version =2.0.23, =0.1.0, =0.0.1, =1.0.274, =0.1.0, =0.2.0, =2.1.0, =0.0.0-pre.2, =0.0.0-next-20230221055802, =0.1.0, =1.0.0, =0.1.1, =0.0.3, =1.0.0, =1.0.2 and more Source cves: CVE-2026-0933 Source advisory: OSV:GHSA-36P8-MVP6-CV38...

@abuiles/vite-plugin (>=1.8.0, <=1.10.0), @anyauth/design-system (>=0.5.0, <=0.5.1) +24 more potentially affected by CVE-2026-0933 via wrangler (>=4.0.0, <=4.59.0)

wrangler NPM version =4.0.0, =1.8.0, =0.5.0, =12.6.6, =0.1.11, =0.8.0, =0.2.0, =0.0.0, =0.0.0-snapshot-001db2706f44e8ac35b9064bbbc2b6f14b577447, =1.0.6, =0.0.0-5788407, =0.0.25, =0.16.0, =1.0.0, =1.1.3 and more Source cves: CVE-2026-0933 Source advisory: OSV:GHSA-36P8-MVP6-CV38...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.6-next.1), @backstage/backend-test-utils (>=1.9.1-next.1, <=1.10.0-next.2) +14 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.13.0-next.0, <=0.13.1-next.1)

@backstage/backend-defaults NPM version =0.13.0-next.0, =0.0.0-nightly-20251122024148, =1.9.1-next.1, =0.4.16-next.0, =0.7.4-next.0, =0.2.14-next.1, =0.7.5-next.0, =0.5.10-next.0, =0.1.4-next.0, =3.0.0-next.0, =0.3.16-next.0, =0.4.15-next.1, =0.3.4-next.1, =2.0.7-next.0, =2.1.1-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.7-next.1), @backstage/backend-test-utils (>=1.10.1-next.0, <=1.10.2-next.1) +14 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (0.14.0-next.1)

@backstage/backend-defaults NPM version 0.14.0-next.1 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/backend-defaults and may be impacted: - @backstage/backend-dynamic-feature-service =0.0.0-nightly-20251218024537, =1.10.1-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.7-next.1), @backstage/backend-test-utils (>=1.10.1-next.0, <=1.10.2-next.1) +14 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (0.14.0-next.1)

@backstage/backend-defaults NPM version 0.14.0-next.1 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/backend-defaults and may be impacted: - @backstage/backend-dynamic-feature-service =0.0.0-nightly-20251218024537, =1.10.1-next.0,...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +252 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-24048 Source advisory:...