@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.6-next.1), @backstage/backend-test-utils (>=1.9.1-next.1, <=1.10.0-next.2) +14 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.13.0-next.0, <=0.13.1-next.1)

@backstage/backend-defaults NPM version =0.13.0-next.0, =0.0.0-nightly-20251122024148, =1.9.1-next.1, =0.4.16-next.0, =0.7.4-next.0, =0.2.14-next.1, =0.7.5-next.0, =0.5.10-next.0, =0.1.4-next.0, =3.0.0-next.0, =0.3.16-next.0, =0.4.15-next.1, =0.3.4-next.1, =2.0.7-next.0, =2.1.1-next.0,...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +252 more potentially affected by CVE-2026-24048 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-24048 Source advisory: OSV:GHSA-Q2X5-4XJX-C6P9...

@backstage/backend-app-api (>=0.0.0-nightly-20241221023113, <=1.4.0-next.1), @backstage/backend-defaults (>=0.0.0-nightly-20241120023536, <=0.15.0-next.2) +111 more potentially affected by CVE-2026-24047 via @backstage/backend-plugin-api (>=1.0.1, <=1.6.0-next.1)

@backstage/backend-plugin-api NPM version =1.0.1, =0.0.0-nightly-20241221023113, =0.0.0-nightly-20241120023536, =0.0.0-nightly-20241120023536, =0.2.0-next.1, =0.0.0-nightly-20241221023113, =0.0.0-nightly-20241121023535, =0.1.26-next.1, =0.0.0-nightly-20250225023230, =0.3.1-next.1, =0.1.1-next.1,...

@backstage/backend-app-api (>=0.0.0-nightly-20220908030128, <=1.4.0-next.1), @backstage/backend-common (>=0.0.0-nightly-202153022114, <=0.0.0-nightly-20240618021721) +155 more potentially affected by CVE-2026-24047 via @backstage/cli-common (>=0.0.0-nightly-2021612205, <=0.1.16-next.2)

@backstage/cli-common NPM version =0.0.0-nightly-2021612205, =0.0.0-nightly-20220908030128, =0.0.0-nightly-202153022114, =0.0.0-nightly-20220908030128, =0.0.0-nightly-20240116021644, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20220908030128, =0.0.0-nightly-20220908030128,...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +252 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-24046 Source advisory: OSV:GHSA-RQ6Q-WR2Q-7PGP...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.7-next.1), @backstage/backend-test-utils (>=1.10.1-next.0, <=1.10.2-next.1) +14 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (0.14.0-next.1)

@backstage/backend-defaults NPM version 0.14.0-next.1 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/backend-defaults and may be impacted: - @backstage/backend-dynamic-feature-service =0.0.0-nightly-20251218024537, =1.10.1-next.0,...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +252 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-24046 Source advisory:...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.6-next.1), @backstage/backend-test-utils (>=1.9.1-next.1, <=1.10.0-next.2) +14 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.13.0-next.0, <=0.13.1-next.1)

@backstage/backend-defaults NPM version =0.13.0-next.0, =0.0.0-nightly-20251122024148, =1.9.1-next.1, =0.4.16-next.0, =0.7.4-next.0, =0.2.14-next.1, =0.7.5-next.0, =0.5.10-next.0, =0.1.4-next.0, =3.0.0-next.0, =0.3.16-next.0, =0.4.15-next.1, =0.3.4-next.1, =2.0.7-next.0, =2.1.1-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.7-next.1), @backstage/backend-test-utils (>=1.10.1-next.0, <=1.10.2-next.1) +14 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (0.14.0-next.1)

@backstage/backend-defaults NPM version 0.14.0-next.1 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/backend-defaults and may be impacted: - @backstage/backend-dynamic-feature-service =0.0.0-nightly-20251218024537, =1.10.1-next.0,...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/backstage-plugin-scaffolder-backend-module-aws-core (>=0.2.14, <=0.2.16) +142 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.11.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.2.14, =0.3.6, =0.2.6, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.0, =0.4.0, =0.4.1 - @backstage-community/backstage-plugin-scaffolder-backend-module-mta 0.4.0 and more Source cves:...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.6-next.1), @backstage/backend-test-utils (>=1.9.1-next.1, <=1.10.0-next.2) +14 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.13.0-next.0, <=0.13.1-next.1)

@backstage/backend-defaults NPM version =0.13.0-next.0, =0.0.0-nightly-20251122024148, =1.9.1-next.1, =0.4.16-next.0, =0.7.4-next.0, =0.2.14-next.1, =0.7.5-next.0, =0.5.10-next.0, =0.1.4-next.0, =3.0.0-next.0, =0.3.16-next.0, =0.4.15-next.1, =0.3.4-next.1, =2.0.7-next.0, =2.1.1-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.0), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.0) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.0-next.0, <=0.12.2-next.1)

@backstage/plugin-scaffolder-node NPM version =0.12.0-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.3.15-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.3.14-next.1, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.9.1-next.1,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.0), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.0) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.0-next.0, <=0.12.2-next.1)

@backstage/plugin-scaffolder-node NPM version =0.12.0-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.3.15-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.3.14-next.1, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.9.1-next.1,...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/backstage-plugin-scaffolder-backend-module-aws-core (>=0.2.14, <=0.2.16) +142 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.11.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.2.14, =0.3.6, =0.2.6, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.0, =0.4.0, =0.4.1 - @backstage-community/backstage-plugin-scaffolder-backend-module-mta 0.4.0 and more Source cves:...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-qofeno/agentx-cli (>=1.20.47, <=1.20.52) +121 more potentially affected by CVE-2026-23957 via seroval (>=1.0.7, <=1.3.2)

seroval NPM version =1.0.7, =0.2.5, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =0.3.2 - @entropy-tamer/reynard-config 0.1.2 - @entropy-tamer/reynard-i18n 1.2.0 - @entropy-tamer/reynard-validation 0.2.0 and more Source cves: CVE-2026-23957 Source advisory:...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-23957 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-23957 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054526...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-qofeno/agentx-cli (>=1.20.47, <=1.20.52) +121 more potentially affected by CVE-2026-23957 via seroval (>=1.0.7, <=1.3.2)

seroval NPM version =1.0.7, =0.2.5, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =0.3.2 - @entropy-tamer/reynard-config 0.1.2 - @entropy-tamer/reynard-i18n 1.2.0 - @entropy-tamer/reynard-validation 0.2.0 and more Source cves: CVE-2026-23957 Source advisory:...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-23956 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-23956 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054521...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-embed/js (>=0.0.1, <=0.0.45) +322 more potentially affected by CVE-2026-23956 via seroval (>=0.2.1, <=1.3.2)

seroval NPM version =0.2.1, =0.2.5, =0.0.1, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.7, =0.0.1, =0.0.1, =1.0.0, =0.1.26, =0.1.38 and more Source cves: CVE-2026-23956 Source advisory: OSV:GHSA-HX9M-JF43-8FFR...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-qofeno/agentx-cli (>=1.20.47, <=1.20.52) +121 more potentially affected by CVE-2026-23956 via seroval (>=1.0.7, <=1.3.2)

seroval NPM version =1.0.7, =0.2.5, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =0.3.2 - @entropy-tamer/reynard-config 0.1.2 - @entropy-tamer/reynard-i18n 1.2.0 - @entropy-tamer/reynard-validation 0.2.0 and more Source cves: CVE-2026-23956 Source advisory:...

@3w5h/knowledge_query (1.0.30), @3w5h/utils (>=1.0.0, <=1.0.7) +611 more potentially affected by CVE-2026-23965 via sm-crypto (>=0.0.9, <=0.3.14)

sm-crypto NPM version =0.0.9, =1.0.0, =0.1.0, =4.4.42, =0.0.2, =2.2.6, =2.2.6, =2.2.6, =2.3.10, =2.1.4, =2.2.6, =2.2.6, =2.2.6, =2.1.15, =2.3.9 and more Source cves: CVE-2026-23965 Source advisory: SNYK:JS-SMCRYPTO-15054484...

@3w5h/knowledge_query (1.0.30), @3w5h/utils (>=1.0.0, <=1.0.7) +611 more potentially affected by CVE-2026-23965 via sm-crypto (>=0.0.9, <=0.3.14)

sm-crypto NPM version =0.0.9, =1.0.0, =0.1.0, =4.4.42, =0.0.2, =2.2.6, =2.2.6, =2.2.6, =2.3.10, =2.1.4, =2.2.6, =2.2.6, =2.2.6, =2.1.15, =2.3.9 and more Source cves: CVE-2026-23965 Source advisory: OSV:GHSA-HPWG-XG7M-3P6M...

cn.herodotus.engine:oauth2-authentication-autoconfigure (>=3.5.5.3, <=3.5.6.2), cn.herodotus.engine:oauth2-authorization-server-autoconfigure (>=3.3.0.5, <=3.5.5.2) +2 more potentially affected by CVE-2026-23965 via org.webjars.npm:sm-crypto (0.3.13)

org.webjars.npm:sm-crypto MAVEN version 0.3.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sm-crypto and may be impacted: - cn.herodotus.engine:oauth2-authentication-autoconfigure =3.5.5.3, =3.3.0.5, =3.3.0.5, =3.5.5.3, =3.5.6.2...

cn.herodotus.engine:oauth2-authentication-autoconfigure (>=3.5.5.3, <=3.5.6.2), cn.herodotus.engine:oauth2-authorization-server-autoconfigure (>=3.3.0.5, <=3.5.5.2) +2 more potentially affected by CVE-2026-23967 via org.webjars.npm:sm-crypto (0.3.13)

org.webjars.npm:sm-crypto MAVEN version 0.3.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sm-crypto and may be impacted: - cn.herodotus.engine:oauth2-authentication-autoconfigure =3.5.5.3, =3.3.0.5, =3.3.0.5, =3.5.5.3, =3.5.6.2...

@ancademy/bespoke-classic-client (>=2.2.6, <=2.7.8-alpha.1), @ancademy/bespoke-classic-robot (>=2.2.6, <=2.7.8-alpha.2) +110 more potentially affected by CVE-2026-23967 via sm-crypto (>=0.0.9, <=0.3.13)

sm-crypto NPM version =0.0.9, =2.2.6, =2.2.6, =2.2.6, =2.3.10, =2.1.4, =2.2.6, =2.2.6, =2.2.6, =2.1.15, =2.7.0, =2.1.15, =2.1.4, =2.7.7, =2.7.0, =2.7.8-alpha.1 and more Source cves: CVE-2026-23967 Source advisory: SNYK:JS-SMCRYPTO-15060560...

@ancademy/bespoke-classic-client (>=2.2.6, <=2.7.8-alpha.1), @ancademy/bespoke-classic-robot (>=2.2.6, <=2.7.8-alpha.2) +110 more potentially affected by CVE-2026-23967 via sm-crypto (>=0.0.9, <=0.3.13)

sm-crypto NPM version =0.0.9, =2.2.6, =2.2.6, =2.2.6, =2.3.10, =2.1.4, =2.2.6, =2.2.6, =2.2.6, =2.1.15, =2.7.0, =2.1.15, =2.1.4, =2.7.7, =2.7.0, =2.7.8-alpha.1 and more Source cves: CVE-2026-23967 Source advisory: OSV:GHSA-QV7W-V773-3XQM...

@ancademy/bespoke-classic-client (>=2.2.6, <=2.7.8-alpha.1), @ancademy/bespoke-classic-robot (>=2.2.6, <=2.7.8-alpha.2) +110 more potentially affected by CVE-2026-23966 via sm-crypto (>=0.0.9, <=0.3.13)

sm-crypto NPM version =0.0.9, =2.2.6, =2.2.6, =2.2.6, =2.3.10, =2.1.4, =2.2.6, =2.2.6, =2.2.6, =2.1.15, =2.7.0, =2.1.15, =2.1.4, =2.7.7, =2.7.0, =2.7.8-alpha.1 and more Source cves: CVE-2026-23966 Source advisory: OSV:GHSA-PGX9-497M-6C4V...

@ancademy/bespoke-classic-client (>=2.2.6, <=2.7.8-alpha.1), @ancademy/bespoke-classic-robot (>=2.2.6, <=2.7.8-alpha.2) +110 more potentially affected by CVE-2026-23966 via sm-crypto (>=0.0.9, <=0.3.13)

sm-crypto NPM version =0.0.9, =2.2.6, =2.2.6, =2.2.6, =2.3.10, =2.1.4, =2.2.6, =2.2.6, =2.2.6, =2.1.15, =2.7.0, =2.1.15, =2.1.4, =2.7.7, =2.7.0, =2.7.8-alpha.1 and more Source cves: CVE-2026-23966 Source advisory: SNYK:JS-SMCRYPTO-15054679...

cn.herodotus.engine:oauth2-authentication-autoconfigure (>=3.5.5.3, <=3.5.6.2), cn.herodotus.engine:oauth2-authorization-server-autoconfigure (>=3.3.0.5, <=3.5.5.2) +2 more potentially affected by CVE-2026-23966 via org.webjars.npm:sm-crypto (0.3.13)

org.webjars.npm:sm-crypto MAVEN version 0.3.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sm-crypto and may be impacted: - cn.herodotus.engine:oauth2-authentication-autoconfigure =3.5.5.3, =3.3.0.5, =3.3.0.5, =3.5.5.3, =3.5.6.2...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-qofeno/agentx-cli (>=1.20.47, <=1.20.52) +121 more potentially affected by CVE-2026-23737 via seroval (>=1.0.7, <=1.3.2)

seroval NPM version =1.0.7, =0.2.5, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =0.3.2 - @entropy-tamer/reynard-config 0.1.2 - @entropy-tamer/reynard-i18n 1.2.0 - @entropy-tamer/reynard-validation 0.2.0 and more Source cves: CVE-2026-23737 Source advisory:...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-qofeno/agentx-cli (>=1.20.47, <=1.20.52) +121 more potentially affected by CVE-2026-23737 via seroval (>=1.0.7, <=1.3.2)

seroval NPM version =1.0.7, =0.2.5, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =0.3.2 - @entropy-tamer/reynard-config 0.1.2 - @entropy-tamer/reynard-i18n 1.2.0 - @entropy-tamer/reynard-validation 0.2.0 and more Source cves: CVE-2026-23737 Source advisory:...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-23737 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-23737 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054507...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-qofeno/agentx-cli (>=1.20.47, <=1.20.52) +121 more potentially affected by CVE-2026-23736 via seroval (>=1.0.7, <=1.3.2)

seroval NPM version =1.0.7, =0.2.5, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =0.3.2 - @entropy-tamer/reynard-config 0.1.2 - @entropy-tamer/reynard-i18n 1.2.0 - @entropy-tamer/reynard-validation 0.2.0 and more Source cves: CVE-2026-23736 Source advisory:...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-23736 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-23736 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054524...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-qofeno/agentx-cli (>=1.20.47, <=1.20.52) +121 more potentially affected by CVE-2026-23736 via seroval (>=1.0.7, <=1.3.2)

seroval NPM version =1.0.7, =0.2.5, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =0.3.2 - @entropy-tamer/reynard-config 0.1.2 - @entropy-tamer/reynard-i18n 1.2.0 - @entropy-tamer/reynard-validation 0.2.0 and more Source cves: CVE-2026-23736 Source advisory:...

@adenta/cms (>=0.0.6, <=1.1.1-0), @adobe/helix-deploy (>=11.0.19, <=11.1.15) +316 more potentially affected by CVE-2026-23950 via tar (>=7.0.0, <=7.5.3)

tar NPM version =7.0.0, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =0.1.1, =0.1.1, =2.17.11, =1.9.5, =8.8.3, =0.0.2, =0.0.22 and more Source cves: CVE-2026-23950 Source advisory: OSV:GHSA-R6Q2-HW4H-H46W...

@orval/angular (>=8.0.0-rc.0, <=8.0.1), @orval/axios (>=8.0.0-rc.0, <=8.0.1) +9 more potentially affected by CVE-2026-23947 +1 more via @orval/core (>=8.0.0, <=8.0.1)

@orval/core NPM version =8.0.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.6, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.1 Source cves: CVE-2026-23947, CVE-2026-25141 Source advisory: OSV:GHSA-H526-WF6G-67JV...

@beshkenadze/orval-mcp (7.11.2-fix.2), @latest-version/orval-angular (7.4.1) +19 more potentially affected by CVE-2026-23947 +1 more via @orval/core (>=7.0.0, <=7.18.0)

@orval/core NPM version =7.0.0, =7.4.1, =7.4.1, =7.4.1, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.9.0, =7.0.0, =7.0.0, =7.0.0, =7.18.0 and more Source cves: CVE-2026-23947, CVE-2026-25141 Source advisory: OSV:GHSA-H526-WF6G-67JV...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @netlify/agent-runner-cli (>=1.31.0-alpha, <=1.58.1-alpha) +14 more potentially affected by CVE-2026-21852 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.64)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =1.31.0-alpha, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =0.11.1, =0.11.0, =1.0.0, =0.10.2, =0.11.5 and more Source cves: CVE-2026-21852 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-15046268...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @netlify/agent-runner-cli (>=1.31.0-alpha, <=1.58.1-alpha) +14 more potentially affected by CVE-2026-21852 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.64)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =1.31.0-alpha, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =0.11.1, =0.11.0, =1.0.0, =0.10.2, =0.11.5 and more Source cves: CVE-2026-21852 Source advisory: OSV:GHSA-JH7P-QR78-84P7...

@abuiles/vite-plugin (>=1.8.0, <=1.10.0), @anyauth/design-system (>=0.5.0, <=0.5.1) +24 more potentially affected by CVE-2026-0933 via wrangler (>=4.0.0, <=4.59.0)

wrangler NPM version =4.0.0, =1.8.0, =0.5.0, =12.6.6, =0.1.11, =0.8.0, =0.2.0, =0.0.0, =0.0.0-snapshot-001db2706f44e8ac35b9064bbbc2b6f14b577447, =1.0.6, =0.0.0-5788407, =0.0.25, =0.16.0, =1.0.0, =1.1.3 and more Source cves: CVE-2026-0933 Source advisory: SNYK:JS-WRANGLER-15046269...

@astrojs/cloudflare (0.4.0), @bookinghub/widget (>=0.1.0, <=0.4.0) +29 more potentially affected by CVE-2026-0933 via wrangler (>=2.0.23, <=3.114.1)

wrangler NPM version =2.0.23, =0.1.0, =0.0.1, =1.0.274, =0.1.0, =0.2.0, =2.1.0, =0.0.0-pre.2, =0.0.0-next-20230221055802, =0.1.0, =1.0.0, =0.1.1, =0.0.3, =1.0.0, =1.0.2 and more Source cves: CVE-2026-0933 Source advisory: SNYK:JS-WRANGLER-15046269...

@alephium/cli (>=0.38.0, <=0.45.0), @alephium/get-extension-wallet (>=0.38.0, <=0.45.0) +19 more potentially affected by CVE-2026-1245 via binary-parser (>=2.0.3, <=2.2.1)

binary-parser NPM version =2.0.3, =0.38.0, =0.38.0, =0.38.0, =0.30.0-beta.1, =0.38.0, =0.38.0, =0.38.0, =0.22.0, =0.0.2, =1.4.1, =0.8.0, =1.13.0, =1.0.0, =2.1.1 and more Source cves: CVE-2026-1245 Source advisory: OSV:GHSA-M39P-34QH-RH3W...

aegis-game (>=2.0.0, <=2.9.10), auditnlg (0.0.1) +30 more potentially affected by CVE-2025-66902 via websocket-server (>=0.4.0, <=0.6.4)

websocket-server PYPI version =0.4.0, =2.0.0, =0.2.3, =0.1.7, =0.2.0, =0.1.0, =0.1.1, =0.1.0, =0.7.0, =0.0.11, =0.2.16 and more Source cves: CVE-2025-66902 Source advisory: SNYK:PYTHON-WEBSOCKETSERVER-15046798...

@dylan1951/polywallet (>=0.22.0, <=0.28.0) potentially affected by CVE-2025-66692 via @trustwallet/wallet-core (4.3.6)

@trustwallet/wallet-core NPM version 4.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on @trustwallet/wallet-core and may be impacted: - @dylan1951/polywallet =0.22.0, =0.28.0 Source cves: CVE-2025-66692 Source advisory:...

@alephium/cli (>=0.38.0, <=0.45.0), @alephium/get-extension-wallet (>=0.38.0, <=0.45.0) +19 more potentially affected by CVE-2026-1245 via binary-parser (>=2.0.3, <=2.2.1)

binary-parser NPM version =2.0.3, =0.38.0, =0.38.0, =0.38.0, =0.30.0-beta.1, =0.38.0, =0.38.0, =0.38.0, =0.22.0, =0.0.2, =1.4.1, =0.8.0, =1.13.0, =1.0.0, =2.1.1 and more Source cves: CVE-2026-1245 Source advisory: SNYK:JS-BINARYPARSER-15046328...

@bagisto-native/core (1.0.2), @bagisto-native/react (>=1.0.0, <=1.0.1) potentially affected by CVE-2025-66803 via @hotwired/turbo (8.0.17)

@hotwired/turbo NPM version 8.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on @hotwired/turbo and may be impacted: - @bagisto-native/core 1.0.2 - @bagisto-native/react =1.0.0, =1.0.1 Source cves: CVE-2025-66803 Source advisory:...

@bagisto-native/core (1.0.2), @bagisto-native/react (>=1.0.0, <=1.0.1) potentially affected by CVE-2025-66803 via @hotwired/turbo (8.0.17)

@hotwired/turbo NPM version 8.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on @hotwired/turbo and may be impacted: - @bagisto-native/core 1.0.2 - @bagisto-native/react =1.0.0, =1.0.1 Source cves: CVE-2025-66803 Source advisory:...

abjad (>=3.20.0, <=3.31.0), abjad-ext-nauert (>=3.20.0, <=3.21.0) +2058 more potentially affected by CVE-2025-56005 via ply (>=3.4.0, <=3.11.0)

ply PYPI version =3.4.0, =3.20.0, =3.20.0, =3.20.0, =1.1.0rc1, =0.1.0.post1, =0.1.5, =4.2.0, =1.0.0, =6.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2025-56005 Source advisory: SNYK:PYTHON-PLY-15046763...

@cmmn/tools (>=3.0.0-alpha-1, <=3.0.0-alpha-6), mikr0 (0.1.10) potentially affected by CVE-2026-22037 via @fastify/express (>=4.0.1, <=4.0.2)

@fastify/express NPM version =4.0.1, =3.0.0-alpha-1, =3.0.0-alpha-6 - mikr0 0.1.10 Source cves: CVE-2026-22037 Source advisory: OSV:GHSA-G6Q3-96CP-5R5M...