2context (>=0.1.0, <=0.2.0), 2ndopinion-cli (>=0.1.0, <=0.12.0) +8834 more potentially affected by CVE-2026-102828 via simple-git (>=3.15.0, <=3.36.0)

simple-git NPM version =3.15.0, =0.1.0, =0.1.0, =0.16.0, =0.0.112-rc1, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0, =1.0.3, =1.1.0, =0.1.0, =0.3.0 and more Source cves: CVE-2026-102828 Source advisory: OSV:GHSA-X6JW-M9V5-85VH...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2762 more potentially affected by unknown CVE via dompurify (>=3.0.0, <=3.4.15)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.0.1, =0.1.0, =0.10.2, =0.12.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-6688-9RHM-GJV2...

@0xsequence/codegenie (>=0.1.0, <=0.7.0), @2h2d/new (>=0.0.2, <=0.1.1-alpha.4) +1053 more potentially affected by unknown CVE via smol-toml (>=1.1.2, <=1.8.0)

smol-toml NPM version =1.1.2, =0.1.0, =0.0.2, =0.1.0, =1.0.0, =0.1.0, =4.10.0, =0.1.3, =0.1.0-beta.1, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-R4XH-JQRQ-34V2...

3d-emoji (>=2.1.0, <=2.3.0), 5g-fe-components (>=1.0.6, <=1.1.0) +8967 more potentially affected by CVE-2026-103923 via katex (>=0.11.0, <=0.18.1)

katex NPM version =0.11.0, =2.1.0, =1.0.6, =1.0.0, =0.0.6, =0.0.0-develop-20260120180031, =0.1.16, =0.1.0, =0.0.3-alpha.37, =0.0.1-alpha.23, =0.0.1-alpha.19, =0.0.1, =0.1.0, =0.10.0 and more Source cves: CVE-2026-103923 Source advisory: OSV:GHSA-238P-PMPM-9MQ7...

@01.software/sdk (>=0.0.1-251008.90016, <=0.0.1-251016.81633), @0xshogun/sdk (>=1.1.4, <=1.1.14) +2566 more potentially affected by CVE-2026-104845 via seroval (>=1.0.7, <=1.6.0)

seroval NPM version =1.0.7, =0.0.1-251008.90016, =1.1.4, =1.1.14, =1.10.1, =1.10.1, =1.10.1, =1.10.1, =1.15.0, =1.17.0, =1.10.1, =1.0.1, =0.0.1, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2026-104845 Source advisory: OSV:GHSA-JP82-F5MQ-HWHP...

@42mo/42mo-web-styles (>=0.0.16, <=0.0.30), @aconex/styleguide (>=2.0.1, <=2.2.0) +1691 more potentially affected by CVE-2026-90711 via proxy-addr (>=1.1.2, <=2.0.7)

proxy-addr NPM version =1.1.2, =0.0.16, =2.0.1, =1.1.0, =0.3.1, =6.1.3, =1.0.0, =0.0.0, =0.7.15, =0.17.5, =1.0.10, =1.2.6 and more Source cves: CVE-2026-90711 Source advisory: OSV:GHSA-JQCG-44MW-7W3H...

@hatung/nx-nest-ddd (>=1.0.0, <=1.1.2), @naxodev/nx-cloudflare (>=5.0.0-rc.0, <=5.0.2) +8 more potentially affected by CVE-2026-104859 via @nx/docker (>=21.4.0, <=22.7.7)

@nx/docker NPM version =21.4.0, =1.0.0, =5.0.0-rc.0, =0.1.29, =0.2.3, =21.4.0-beta.4, =21.4.0-beta.4, =21.4.0-beta.4, =0.7.6, =0.0.3, =0.3.5 - @ziacik/azure-func 5.0.0 Source cves: CVE-2026-104859 Source advisory: OSV:GHSA-6VC5-VF29-FFR2...

@nx/express (>=23.0.0-beta.0, <=23.1.0), @nx/nest (>=23.0.0-beta.0, <=23.1.0) +1 more potentially affected by CVE-2026-104859 via @nx/docker (>=23.0.0, <=23.1.0-rc.3)

@nx/docker NPM version =23.0.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.1.0 Source cves: CVE-2026-104859 Source advisory: OSV:GHSA-6VC5-VF29-FFR2...

@aws/nx-plugin (>=1.0.0-rc.24, <=1.0.0-rc.87), @brabander/config-eslint (>=0.1.1, <=0.5.1) +175 more potentially affected by CVE-2026-104854 via nx (>=23.0.0, <=23.1.1)

nx NPM version =23.0.0, =1.0.0-rc.24, =0.1.1, =1.0.0-alpha.0, =0.3.1, =1.0.0-rc.39, =0.0.2-10, =1.1.0-alpha.3, =0.20.2, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.1.1 and more Source cves: CVE-2026-104854 Source advisory: OSV:GHSA-W3VV-58GJ-GW77...

@0xdeepak/wallets (0.0.2), @10xsai/cloudflare-router-nx-plugin (1.0.0) +1161 more potentially affected by CVE-2026-104854 via nx (>=14.6.0, <=22.7.8)

nx NPM version =14.6.0, =1.2.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.2.1, =0.0.1, =0.0.1, =0.1.5, =0.1.8 and more Source cves: CVE-2026-104854 Source advisory: OSV:GHSA-W3VV-58GJ-GW77...

@aws/nx-plugin (>=1.0.0-rc.24, <=1.0.0), @brabander/config-eslint (>=0.1.1, <=0.5.1) +177 more potentially affected by CVE-2026-104853 via nx (>=23.0.0, <=23.2.0-rc.2)

nx NPM version =23.0.0, =1.0.0-rc.24, =0.1.1, =1.0.0-alpha.0, =0.3.1, =1.0.0-rc.39, =0.0.2-10, =1.1.0-alpha.3, =0.4.0, =0.20.2, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.2.0 and more Source cves: CVE-2026-104853 Source advisory: OSV:GHSA-HRVQ-X7JP-36XV...

@0xdeepak/wallets (0.0.2), @10xsai/cloudflare-router-nx-plugin (1.0.0) +1191 more potentially affected by CVE-2026-104853 via nx (>=13.10.0, <=22.7.9)

nx NPM version =13.10.0, =1.2.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.2.1, =0.0.1, =0.0.1, =0.1.5, =0.1.8 and more Source cves: CVE-2026-104853 Source advisory: OSV:GHSA-HRVQ-X7JP-36XV...

01basicreact (>=0.1.0, <=0.1.9), 10by10-react-app (1.2.1) +6200 more potentially affected by CVE-2026-87776 via compression (>=1.0.0, <=1.8.1)

compression NPM version =1.0.0, =0.1.0, =0.30.0, =4.11.0, =0.0.0-canary.0, =0.0.1, =2.0.1, =0.1.1, =1.0.0, =1.0.3 and more Source cves: CVE-2026-87776 Source advisory: OSV:GHSA-VC2V-76PW-4V95...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +294 more potentially affected by CVE-2026-100723 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.34-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4 - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +195 more potentially affected by CVE-2026-104852 via @graphql-tools/utils (12.0.0-alpha-20260811213401-1eff5799faeb287f78dcafd6415e2afe144cee07)

@graphql-tools/utils NPM version 12.0.0-alpha-20260811213401-1eff5799faeb287f78dcafd6415e2afe144cee07 is affected by a known vulnerability. The following packages have a transitive dependency on @graphql-tools/utils and may be impacted: - @adamwdennis/nestjs-typeorm-cursor-pagination 1.0.0 -...

create-graphene (>=0.0.24, <=0.0.30) potentially affected by CVE-2026-86597 via snowflake-sdk (3.1.0)

snowflake-sdk NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-sdk and may be impacted: - create-graphene =0.0.24, =0.0.30 Source cves: CVE-2026-86597 Source advisory: OSV:GHSA-QQJ6-54Q6-CXV6...

@1stg/app-config (>=10.0.0, <=15.0.0), @1stg/common-config (>=10.0.0, <=15.0.0) +450 more potentially affected by CVE-2026-104844 via postcss-selector-parser (>=7.0.0, <=7.1.5)

postcss-selector-parser NPM version =7.0.0, =10.0.0, =10.0.0, =8.1.0, =13.0.0, =0.1.0-dev25004766367, =0.7.0-rohit-magnitude-valuetext.1, =1.0.3, =1.11.1, =1.11.1, =1.11.1, =1.12.0, =1.11.1, =1.11.1, =1.11.1, =1.11.1, =1.55.8 and more Source cves: CVE-2026-104844 Source advisory:...

3d-card (0.0.2), @cosla/sensemaking-web-ui (>=1.0.5, <=1.0.9) +19 more potentially affected by CVE-2026-104871 via @angular/ssr (>=19.0.5, <=19.2.27)

@angular/ssr NPM version =19.0.5, =1.0.5, =19.0.0-beta.1, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =0.0.2, =19.1.0, =16.0.0, =0.0.0, =0.0.0, =0.0.5 and more Source cves: CVE-2026-104871 Source advisory: OSV:GHSA-7G7C-H8RR-7P6Q...

create-momentum-app (>=0.1.2, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-104871 via @angular/ssr (>=21.1.2, <=21.2.7)

@angular/ssr NPM version =21.1.2, =0.1.2, =0.0.2, =0.0.3 Source cves: CVE-2026-104871 Source advisory: OSV:GHSA-7G7C-H8RR-7P6Q...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) potentially affected by CVE-2026-104871 via @angular/ssr (>=20.3.18, <=20.3.24)

@angular/ssr NPM version =20.3.18, =7.3.49-4369, =4.2.16-4435, =4.2.17 Source cves: CVE-2026-104871 Source advisory: OSV:GHSA-7G7C-H8RR-7P6Q...

@vnejs/bundles.canvas.react (>=0.1.1, <=0.2.0), @vnejs/bundles.checkers (>=0.2.1, <=0.2.3) +7 more potentially affected by CVE-2026-103922 via @capacitor/android (8.0.2)

@capacitor/android NPM version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @capacitor/android and may be impacted: - @vnejs/bundles.canvas.react =0.1.1, =0.2.1, =0.1.0, =0.1.36, =0.1.2, =0.1.1, =0.1.1, =0.1.1, =0.2.20, =0.2.31 Source cves:...

@tak-ps/cloudtak (>=12.134.0, <=12.138.1), @vnejs/bundles.canvas.react (>=0.1.1, <=0.2.0) +8 more potentially affected by CVE-2026-103922 via @capacitor/ios (>=8.0.2, <=8.3.1)

@capacitor/ios NPM version =8.0.2, =12.134.0, =0.1.1, =0.2.1, =0.1.0, =0.1.36, =0.1.2, =0.1.1, =0.1.1, =0.1.1, =0.2.20, =0.2.31 Source cves: CVE-2026-103922 Source advisory: OSV:GHSA-RVM3-566M-V7FV...

@cotecna/stencil-components (>=3.0.0, <=3.2.1), meta-g (>=1.0.0, <=1.0.494998) +1 more potentially affected by CVE-2026-103922 via @capacitor/ios (>=6.0.0-nightly-20240307T150431.0, <=6.1.2)

@capacitor/ios NPM version =6.0.0-nightly-20240307T150431.0, =3.0.0, =1.0.0, =1.0.0, =1.1.6 Source cves: CVE-2026-103922 Source advisory: OSV:GHSA-RVM3-566M-V7FV...

@cotecna/stencil-components (>=3.3.1, <=4.0.0), @happyknuckles/angular-standalone-clean-code (0.0.2) +2 more potentially affected by CVE-2026-103922 via @capacitor/ios (>=7.0.1, <=7.4.4)

@capacitor/ios NPM version =7.0.1, =3.3.1, =0.0.24, =1.0.1, =1.8.0 Source cves: CVE-2026-103922 Source advisory: OSV:GHSA-RVM3-566M-V7FV...

@cotecna/stencil-components (>=3.3.1, <=4.0.0), @happyknuckles/angular-standalone-clean-code (0.0.2) +3 more potentially affected by CVE-2026-103922 via @capacitor/android (>=7.0.1, <=7.4.4)

@capacitor/android NPM version =7.0.1, =3.3.1, =0.0.24, =1.0.1, =0.0.1, =0.0.2 Source cves: CVE-2026-103922 Source advisory: OSV:GHSA-RVM3-566M-V7FV...

@cotecna/stencil-components (>=3.0.0, <=3.2.1), @sumaris-net/ngx-components (18.5.0-alpha2) +2 more potentially affected by CVE-2026-103922 via @capacitor/android (>=6.0.0-nightly-20240307T150431.0, <=6.2.0)

@capacitor/android NPM version =6.0.0-nightly-20240307T150431.0, =3.0.0, =1.0.0, =1.0.0, =1.1.6 Source cves: CVE-2026-103922 Source advisory: OSV:GHSA-RVM3-566M-V7FV...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +1718 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-cassandra-driver (>=0.27.1, <=0.65.0)

@opentelemetry/instrumentation-cassandra-driver NPM version =0.27.1, =0.1.0, =0.0.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.3.4-0, =5.1.1-staging.260347880488, =5.1.1-staging.260347880488, =6.0.3 and...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +2976 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-tedious (>=0.4.0, <=0.39.0)

@opentelemetry/instrumentation-tedious NPM version =0.4.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3016 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-knex (>=0.27.1, <=0.64.0)

@opentelemetry/instrumentation-knex NPM version =0.27.1, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3312 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-pg (>=0.15.0, <=0.72.0)

@opentelemetry/instrumentation-pg NPM version =0.15.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3057 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mysql2 (>=0.26.0, <=0.66.0)

@opentelemetry/instrumentation-mysql2 NPM version =0.26.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3073 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mysql (>=0.15.0, <=0.66.0)

@opentelemetry/instrumentation-mysql NPM version =0.15.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +911 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-oracledb (>=0.27.0, <=0.45.0)

@opentelemetry/instrumentation-oracledb NPM version =0.27.0, =0.1.0, =0.0.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.7, =5.1.1-staging.260347880488, =5.1.1-staging.260347880488, =5.1.1-staging.260347880488,...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3007 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mongoose (>=0.31.0, <=0.66.0)

@opentelemetry/instrumentation-mongoose NPM version =0.31.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @1-/fix (>=0.1.4, <=0.1.10) +465 more potentially affected by CVE-2026-104848 via tinypool (>=2.0.0, <=2.1.0)

tinypool NPM version =2.0.0, =0.0.1, =0.1.4, =15.0.0, =1.57.7, =1.3.0, =3.0.0-next-3def11e, =0.0.0-next.d8e717b, =2.23.0, =0.0.1, =1.0.0, =0.6.0-alpha.26, =0.6.0-alpha.26, =1.1.0, =0.4.0, =1.0.0-rohit-ds-tokens-and-primitives.1 and more Source cves: CVE-2026-104848 Source advisory:...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @1-/fix (>=0.1.4, <=0.1.10) +465 more potentially affected by CVE-2026-104849 via tinypool (>=2.0.0, <=2.1.0)

tinypool NPM version =2.0.0, =0.0.1, =0.1.4, =15.0.0, =1.57.7, =1.3.0, =3.0.0-next-3def11e, =0.0.0-next.d8e717b, =2.23.0, =0.0.1, =1.0.0, =0.6.0-alpha.26, =0.6.0-alpha.26, =1.1.0, =0.4.0, =1.0.0-rohit-ds-tokens-and-primitives.1 and more Source cves: CVE-2026-104849 Source advisory:...

authowl (>=0.3.0, <=0.3.12), quicktype (>=26.0.0-pre1, <=26.0.0) +1 more potentially affected by CVE-2026-104183 via stream-json (3.5.0)

stream-json NPM version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on stream-json and may be impacted: - authowl =0.3.0, =26.0.0-pre1, =0.1.0, =0.1.1 Source cves: CVE-2026-104183 Source advisory: OSV:GHSA-MJW6-4JJ6-33HC...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +294 more potentially affected by CVE-2026-92959 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@aiconnect/codelets-runner (>=0.1.0, <=0.2.0), @cairncms/api (>=1.0.0-beta.1, <=1.0.0-beta.4) +27 more potentially affected by CVE-2026-92954 via vm2 (>=3.10.0, <=3.11.6)

vm2 NPM version =3.10.0, =0.1.0, =1.0.0-beta.1, =3.0.46, =0.1.0, =2.32.0, =0.0.16, =1.4.13, =1.0.0, =1.0.0-beta.1, =1.1.0, =0.2.0, =1.0.0, =3.1.4 and more Source cves: CVE-2026-92954 Source advisory: OSV:GHSA-GJQ8-XM47-88RC...

@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +22 more potentially affected by CVE-2026-92953 via vm2 (>=3.11.1, <=3.11.6)

vm2 NPM version =3.11.1, =3.0.57, =0.1.0, =2.32.0, =0.0.16, =1.4.13, =1.0.0, =1.1.0, =0.2.0, =1.0.0, =3.1.3, =2.32.0, =1.72.3, =2.0.9 and more Source cves: CVE-2026-92953 Source advisory: OSV:GHSA-3VGF-8M4Q-Q4QR...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +294 more potentially affected by CVE-2026-92934 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@9troisquarts/ant-form (>=2.0.1, <=4.0.5), @activepieces/piece-jira-cloud (>=0.1.13, <=0.3.6) +653 more potentially affected by CVE-2026-104847 via prosemirror-view (>=1.3.0, <=1.42.2)

prosemirror-view NPM version =1.3.0, =2.0.1, =0.1.13, =3.0.0-beta.4, =0.4.0, =11.21.3, =0.1.0, =11.19.4, =11.13.0, =0.0.1, =13.1.0, =1.7.5, =10.4.0, =0.0.2, =0.0.9 and more Source cves: CVE-2026-104847 Source advisory: OSV:GHSA-C8X8-7FP4-3X9W...

@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +22 more potentially affected by CVE-2026-92936 via vm2 (>=3.11.1, <=3.11.6)

vm2 NPM version =3.11.1, =3.0.57, =0.1.0, =2.32.0, =0.0.16, =1.4.13, =1.0.0, =1.1.0, =0.2.0, =1.0.0, =3.1.3, =2.32.0, =1.72.3, =2.0.9 and more Source cves: CVE-2026-92936 Source advisory: OSV:GHSA-X6M4-CHR9-CG97...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +294 more potentially affected by CVE-2026-92946 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@c15t/backend (>=1.1.0-canary.0, <=1.8.6), @c15t/cli (>=1.1.0-canary.0, <=1.8.6) +11 more potentially affected by CVE-2026-103918 via @orpc/zod (>=1.2.0, <=1.14.8)

@orpc/zod NPM version =1.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.2.0-canary.0, =0.0.3, =0.0.12 Source cves: CVE-2026-103918 Source advisory: OSV:GHSA-GCGF-FH7C-8GF2...

@ampproject/eleventy-plugin-amp (>=0.5.6, <=0.5.8), @ampproject/toolbox-cli (>=2.0.0-alpha.0, <=3.0.0-canary.2) +37 more potentially affected by CVE-2026-104861 via probe-image-size (>=7.0.0, <=7.3.0)

probe-image-size NPM version =7.0.0, =0.5.6, =2.0.0-alpha.0, =2.8.0-canary.6, =2.8.8, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =14.9.23-prev, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.11.0, =7.0.0 and more Source cves: CVE-2026-104861 Source advisory: OSV:GHSA-GJJ5-9665-RWRC...

0xble (>=22.0.0, <=23.2.2), 0xsodium (>=0.2.0, <=0.14.0) +14044 more potentially affected by CVE-2026-19481 via @fastify/busboy (>=1.0.0, <=3.2.0)

@fastify/busboy NPM version =1.0.0, =22.0.0, =0.2.0, =0.0.1, =1.0.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.0.21, =0.6.0, =0.6.2 and more Source cves: CVE-2026-19481 Source advisory: OSV:GHSA-X8MW-P69M-V3MX...

@awmottaz/grackle (>=3.0.0, <=3.2.0), @beiguancyc/parse-server (>=9.9.0-ruixiang.1, <=9.10.0-ruixiang.4) +14 more potentially affected by CVE-2026-19484 via @fastify/busboy (>=3.1.1, <=3.2.0)

@fastify/busboy NPM version =3.1.1, =3.0.0, =9.9.0-ruixiang.1, =0.37.0, =0.8.22, =0.9.21, =1.0.4, =1.0.0, =4.5.0-blowfish-pre, =11.1.1-9.0, =6.1.1, =3.31.25, =9.2.8-0, =9.10.0-1, =0.27.0, =4.0.0, =4.2.0 and more Source cves: CVE-2026-19484 Source advisory: OSV:GHSA-XJH9-V7X6-24JW...

@a2ui/angular (>=0.9.0-alpha.0, <=0.9.1), @a2ui/lit (>=0.9.1, <=0.9.3) +43 more potentially affected by CVE-2026-10032 via @a2ui/web_core (>=0.9.0, <=0.9.2)

@a2ui/webcore NPM version =0.9.0, =0.9.0-alpha.0, =0.9.1, =0.9.0-alpha.0, =0.0.1-beta.1, =0.0.1-beta.1, =0.0.1-beta.1, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.5.1 and more Source cves: CVE-2026-10032 Source advisory: OSV:GHSA-72QQ-P3R5-F7WQ...