agent-vm-hermes-adapter (>=0.0.122, <=0.0.153), agenta (>=0.105.1, <=0.122.8) +107 more potentially affected by CVE-2026-112006 via opentelemetry-exporter-otlp-proto-http (1.44.0)

opentelemetry-exporter-otlp-proto-http PYPI version 1.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on opentelemetry-exporter-otlp-proto-http and may be impacted: - agent-vm-hermes-adapter =0.0.122, =0.105.1, =1.8.1, =1.0.0b2, =0.0.0, =0.20.0,...

@diviops/mcp-server (>=1.5.56, <=1.5.73), @l1nxuan-du/dsh (0.1.6-fork-alpha.2.20260920.1) +52 more potentially affected by CVE-2026-111997 via ip-address (>=10.7.0, <=10.7.3)

ip-address NPM version =10.7.0, =1.5.56, =0.19.6, =4.1.6, =3.1.82, =2.6.58, =3.8.6, =2.7.154, =3.1.54, =4.0.28, =3.1.78, =3.0.127, =3.5.37, =3.5.59 and more Source cves: CVE-2026-111997 Source advisory: MEND:CVE-2026-111997...

ai.abkr.open:any (>=1.0.6, <=1.0.22), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +12836 more potentially affected by CVE-2026-68498 via tools.jackson.core:jackson-core (>=3.0.0, <=3.1.5)

tools.jackson.core:jackson-core MAVEN version =3.0.0, =1.0.6, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.2.0, =0.2.0, =0.2.0, =0.4.4 and more Source cves:...

ai.covia:covia-claude-code (>=0.9.3, <=0.9.11), ai.covia:covia-discord (>=0.9.4, <=0.9.9) +10584 more potentially affected by CVE-2026-68498 via com.fasterxml.jackson.core:jackson-core (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.22.0, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.9, =0.9.6, =0.7.0, =0.9.3, =0.9.9, =0.7.0, =0.7.0, =0.1.0-beta.1, =0.1.1, =1.4.0, =1.4.0, =2.0.0 and more Source cves: CVE-2026-68498 Source advisory: MEND:CVE-2026-68498...

ac.pao:reports-java-engine (1.0.0), ae.alphapay:alphapay-gateway-client (2.0.0) +44386 more potentially affected by CVE-2026-68498 via com.fasterxml.jackson.core:jackson-core (>=2.16.0, <=2.18.9)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.16.0, =1.0.0, =1.0.0, =0.1.0, =0.1.1, =0.1.0-rc4, =0.1.0-rc4, =0.1.3, =0.1.4 and more Source cves: CVE-2026-68498 Source advisory: MEND:CVE-2026-68498...

ai.pipestream.proto-toolchain:ai.pipestream.proto-toolchain.gradle.plugin (>=0.7.24, <=0.7.26), ai.pipestream:quarkus-buf-grpc-generator (>=0.7.24, <=0.7.26) +2254 more potentially affected by CVE-2026-68498 via tools.jackson.core:jackson-core (>=3.2.0, <=3.2.1)

tools.jackson.core:jackson-core MAVEN version =3.2.0, =0.7.24, =0.7.24, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.0.0-alpha4, =2.0.0-alpha4, =2.0.0-alpha4, =2.0.0-alpha4, =2.0.0-alpha4, =2.0.0-alpha6 - at.meks.quarkiverse.axonframework-extension:quarkus-axon-metrics-deploym...

ac.pao:reports-web (1.0.0), ai.aarvion:aarvion-spring-boot-starter (>=0.1.0, <=0.2.0) +36795 more potentially affected by CVE-2026-68498 via com.fasterxml.jackson.core:jackson-core (>=2.19.0, <=2.21.5)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.19.0, =0.1.0, =1.0.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.6 and more Source cves:...

lmcache-vllm (>=0.6.1rc1, <=0.6.2.1) potentially affected by CVE-2026-105192 via lmcache (0.4.3)

lmcache PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on lmcache and may be impacted: - lmcache-vllm =0.6.1rc1, =0.6.2.1 Source cves: CVE-2026-105192 Source advisory: GHSA-W5F2-9Q9C-FF4H...

lmcache-vllm (>=0.6.1rc1, <=0.6.2.1) potentially affected by CVE-2026-105192 via lmcache (0.4.3)

lmcache PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on lmcache and may be impacted: - lmcache-vllm =0.6.1rc1, =0.6.2.1 Source cves: CVE-2026-105192 Source advisory: OSV:GHSA-W5F2-9Q9C-FF4H...

acroform (>=0.1.2, <=0.1.3), bookbinder (0.1.0) +96 more potentially affected by unknown CVE via lopdf (>=0.8.0, <=0.41.0)

lopdf CARGO version =0.8.0, =0.1.2, =0.1.0, =0.0.1, =0.3.0, =0.1.10, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.4.0, =0.7.3 - ebook-reader 0.1.1 - epub-reader 0.1.1 and more Source cves: unknown CVE Source advisory: GHSA-6FJ4-RCR3-R7RR...

acroform (>=0.1.2, <=0.1.3), bookbinder (0.1.0) +96 more potentially affected by unknown CVE via lopdf (>=0.8.0, <=0.41.0)

lopdf CARGO version =0.8.0, =0.1.2, =0.1.0, =0.0.1, =0.3.0, =0.1.10, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.4.0, =0.7.3 - ebook-reader 0.1.1 - epub-reader 0.1.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-6FJ4-RCR3-R7RR...

ai.djl.audio:audio (>=0.18.0, <=0.38.0), ai.djl.spark:spark_2.12 (>=0.22.0, <=0.38.0) +461 more potentially affected by CVE-2026-102834 via org.bytedeco:javacv (>=1.0, <=1.5.13)

org.bytedeco:javacv MAVEN version =1.0, =0.18.0, =0.22.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.3.0 and more Source cves: CVE-2026-102834 Source advisory: GHSA-RXJV-24XQ-76WC...

com.github.sarxos:webcam-capture-driver-javacv (0.3.10), info.kapable:automationscenarioapi (1.0.0) +3 more potentially affected by CVE-2026-102834 via org.bytedeco:javacv (0.8)

org.bytedeco:javacv MAVEN version 0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.bytedeco:javacv and may be impacted: - com.github.sarxos:webcam-capture-driver-javacv 0.3.10 - info.kapable:automationscenarioapi 1.0.0 - org.bytedeco:procamcalib...

org.bytedeco:procamcalib (0.9), org.bytedeco:procamtracker (0.9) potentially affected by CVE-2026-102834 via org.bytedeco:javacv (0.9)

org.bytedeco:javacv MAVEN version 0.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.bytedeco:javacv and may be impacted: - org.bytedeco:procamcalib 0.9 - org.bytedeco:procamtracker 0.9 Source cves: CVE-2026-102834 Source advisory:...

org.bytedeco:procamcalib (0.10), org.bytedeco:procamtracker (0.10) potentially affected by CVE-2026-102834 via org.bytedeco:javacv (0.10)

org.bytedeco:javacv MAVEN version 0.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.bytedeco:javacv and may be impacted: - org.bytedeco:procamcalib 0.10 - org.bytedeco:procamtracker 0.10 Source cves: CVE-2026-102834 Source advisory:...

ai.djl.audio:audio (>=0.18.0, <=0.38.0), ai.djl.spark:spark_2.12 (>=0.22.0, <=0.38.0) +461 more potentially affected by CVE-2026-102834 via org.bytedeco:javacv (>=1.0, <=1.5.13)

org.bytedeco:javacv MAVEN version =1.0, =0.18.0, =0.22.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.3.0 and more Source cves: CVE-2026-102834 Source advisory: OSV:GHSA-RXJV-24XQ-76WC...

org.bytedeco:procamcalib (0.11), org.bytedeco:procamtracker (0.11) potentially affected by CVE-2026-102834 via org.bytedeco:javacv (0.11)

org.bytedeco:javacv MAVEN version 0.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.bytedeco:javacv and may be impacted: - org.bytedeco:procamcalib 0.11 - org.bytedeco:procamtracker 0.11 Source cves: CVE-2026-102834 Source advisory:...

ai.djl.audio:audio (>=0.18.0, <=0.38.0), ai.djl.spark:spark_2.12 (>=0.22.0, <=0.38.0) +463 more potentially affected by CVE-2026-102834 via org.bytedeco:javacv (>=0.8, <=1.5.13)

org.bytedeco:javacv MAVEN version =0.8, =0.18.0, =0.22.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.3.0 and more Source cves: CVE-2026-102834 Source advisory: MEND:CVE-2026-102834...

agent-framework-claude (>=1.0.0b260319, <=1.0.0b260521), agent-webkit-server (>=0.1.0, <=0.2.0) +44 more potentially affected by CVE-2026-96620 via claude-agent-sdk (>=0.1.9, <=0.2.120)

claude-agent-sdk PYPI version =0.1.9, =1.0.0b260319, =0.1.0, =0.1.0, =0.1.0, =8.1.0, =0.3.12, =0.3.0, =0.4.0, =0.5.1, =0.1.12, =0.4.3, =0.1.0, =0.1.2 - expluro 0.9.0 - glyph-agents 0.3.0 - gobby 0.3.4 and more Source cves: CVE-2026-96620 Source advisory: OSV:GHSA-H4MW-J7QP-8MWM...

agent-framework-claude (>=1.0.0b260319, <=1.0.0b260521), agent-webkit-server (>=0.1.0, <=0.2.0) +44 more potentially affected by CVE-2026-96620 via claude-agent-sdk (>=0.1.9, <=0.2.120)

claude-agent-sdk PYPI version =0.1.9, =1.0.0b260319, =0.1.0, =0.1.0, =0.1.0, =8.1.0, =0.3.12, =0.3.0, =0.4.0, =0.5.1, =0.1.12, =0.4.3, =0.1.0, =0.1.2 - expluro 0.9.0 - glyph-agents 0.3.0 - gobby 0.3.4 and more Source cves: CVE-2026-96620 Source advisory: GHSA-H4MW-J7QP-8MWM...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0, <=5.0.4) potentially affected by CVE-2026-108743 via org.apache.kylin:kylin-core-common (>=5.0.0, <=5.0.4)

org.apache.kylin:kylin-core-common MAVEN version =5.0.0, =5.0.0, =5.0.4 Source cves: CVE-2026-108743 Source advisory: MEND:CVE-2026-108743...

agent-framework-claude (>=1.0.0b260319, <=1.0.0b260521), agent-webkit-server (>=0.1.0, <=0.2.0) +44 more potentially affected by CVE-2026-96620 via claude-agent-sdk (>=0.1.9, <=0.2.120)

claude-agent-sdk PYPI version =0.1.9, =1.0.0b260319, =0.1.0, =0.1.0, =0.1.0, =8.1.0, =0.3.12, =0.3.0, =0.4.0, =0.5.1, =0.1.12, =0.4.3, =0.1.0, =0.1.2 - expluro 0.9.0 - glyph-agents 0.3.0 - gobby 0.3.4 and more Source cves: CVE-2026-96620 Source advisory: MEND:CVE-2026-96620...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0, <=5.0.4) potentially affected by CVE-2026-108709 via org.apache.kylin:kylin-core-common (>=5.0.0, <=5.0.4)

org.apache.kylin:kylin-core-common MAVEN version =5.0.0, =5.0.0, =5.0.4 Source cves: CVE-2026-108709 Source advisory: MEND:CVE-2026-108709...

@tsg-ailab/dynamics-crm-mcp (>=1.0.0-beta.33617, <=1.0.0) potentially affected by CVE-2026-109461 via @azure/msal-node (7.0.1)

@azure/msal-node NPM version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @azure/msal-node and may be impacted: - @tsg-ailab/dynamics-crm-mcp =1.0.0-beta.33617, =1.0.0 Source cves: CVE-2026-109461 Source advisory: MEND:CVE-2026-109461...

accesskit_atspi_common (>=0.1.1, <=0.9.1), accesskit_unix (>=0.1.0, <=0.12.1) +226 more potentially affected by unknown CVE via zvariant_derive (>=2.2.0, <=5.15.1)

zvariantderive CARGO version =2.2.0, =0.1.1, =0.1.0, =0.8.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.5.0, =1.0.0, =0.1.0, =0.3.4 - benchscraper 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0372...

accesskit_atspi_common (>=0.1.1, <=0.9.1), accesskit_unix (>=0.1.0, <=0.12.1) +193 more potentially affected by unknown CVE via zbus_names (>=1.1.0, <=4.3.5)

zbusnames CARGO version =1.1.0, =0.1.1, =0.1.0, =0.8.0, =0.2.0-alpha, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.5.0, =1.0.0, =0.1.0, =0.0.1, =0.1.14 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0371...

accesskit_atspi_common (>=0.1.1, <=0.9.1), accesskit_unix (>=0.1.0, <=0.12.1) +226 more potentially affected by unknown CVE via zvariant (>=2.1.0, <=5.15.1)

zvariant CARGO version =2.1.0, =0.1.1, =0.1.0, =0.8.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.5.0, =1.0.0, =0.1.0, =0.3.4 - benchscraper 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0370...

astrapi-backup (>=26.8.1, <=26.8.16), b9gemyaeix (>=4.14.0, <=4.14.1) +5 more potentially affected by CVE-2026-62268 via borgbackup (>=1.1.13, <=1.4.4)

borgbackup PYPI version =1.1.13, =26.8.1, =4.14.0, =0.1.3.dev1, =0.12.0, =4.9.0, =2026.7.1 - weblate-fedora-messaging 0.6.0 Source cves: CVE-2026-62268 Source advisory: MEND:CVE-2026-62268...

apache-airflow-providers-sftp (>=4.2.1rc1, <=4.9.0rc1) potentially affected by CVE-2026-94134 +1 more via apache-airflow-providers-ssh (7.0.0rc1)

apache-airflow-providers-ssh PYPI version 7.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-ssh and may be impacted: - apache-airflow-providers-sftp =4.2.1rc1, =4.9.0rc1 Source cves: CVE-2026-94134, CVE-2026-94135 Source...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @cangjielang/aceharness (>=1.0.0-rc.11, <=1.0.0-rc.13-test.0) +26 more potentially affected by CVE-2026-102989 via @tanstack/react-start (>=1.166.18, <=1.168.50)

@tanstack/react-start NPM version =1.166.18, =2.0.0-beta.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.5.0, =0.0.0, =0.0.2 - @kstackz/auth-toolkit 0.0.0 and more Source cves: CVE-2026-102989 Source advisory: OSV:GHSA-QX66-FV34-FJM8...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @bgub/fig-tanstack-start (>=0.1.0-alpha.1, <=1.0.0) +43 more potentially affected by CVE-2026-102989 via @tanstack/start-server-core (>=1.143.12, <=1.169.38)

@tanstack/start-server-core NPM version =1.143.12, =2.0.0-beta.1, =0.1.0-alpha.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =1.168.32-depup.0, =0.1.31-depup.0, =1.167.23-depup.0, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.2.0 and more Source cves: CVE-2026-102989 Source advisory:...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @bgub/fig-tanstack-start (>=0.1.0-alpha.1, <=1.0.0) +43 more potentially affected by CVE-2026-102989 via @tanstack/start-server-core (>=1.143.12, <=1.169.38)

@tanstack/start-server-core NPM version =1.143.12, =2.0.0-beta.1, =0.1.0-alpha.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =1.168.32-depup.0, =0.1.31-depup.0, =1.167.23-depup.0, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.2.0 and more Source cves: CVE-2026-102989 Source advisory: GHSA-QX66-FV34-FJ...

@apimatic/cli (>=2.0.0-beta.1, <=2.0.0-beta.6), @cangjielang/aceharness (>=1.0.0-rc.11, <=1.0.0-rc.13-test.0) +26 more potentially affected by CVE-2026-102989 via @tanstack/react-start (>=1.166.18, <=1.168.50)

@tanstack/react-start NPM version =1.166.18, =2.0.0-beta.1, =1.0.0-rc.11, =2.0.0, =2.0.0, =0.1.1, =0.2.0, =0.1.77, =0.1.50, =0.1.43, =0.1.8, =0.5.0, =0.0.0, =0.0.2 - @kstackz/auth-toolkit 0.0.0 and more Source cves: CVE-2026-102989 Source advisory: GHSA-QX66-FV34-FJM8...

calibrate-agent (>=0.0.55, <=0.0.77), nvidia-pipecat (0.4.0) +11 more potentially affected by CVE-2026-102682 via pipecat-ai (>=0.0.98, <=1.4.0)

pipecat-ai PYPI version =0.0.98, =0.0.55, =0.1.0, =0.0.5, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.7.1.dev260608103499798499, =2.1.0 Source cves: CVE-2026-102682 Source advisory: GHSA-HQM2-CFX2-2VGH...

calibrate-agent (>=0.0.55, <=0.0.77), nvidia-pipecat (0.4.0) +11 more potentially affected by CVE-2026-102682 via pipecat-ai (>=0.0.98, <=1.4.0)

pipecat-ai PYPI version =0.0.98, =0.0.55, =0.1.0, =0.0.5, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.7.1.dev260608103499798499, =2.1.0 Source cves: CVE-2026-102682 Source advisory: OSV:GHSA-HQM2-CFX2-2VGH...

jupyterlite-pyodide-kernel (>=0.7.0a0, <=0.7.2), jupyterlite-sphinx (>=0.22.0, <=0.22.1) +5 more potentially affected by CVE-2026-102832 via jupyterlite-core (>=0.7.6, <=0.8.0rc0)

jupyterlite-core PYPI version =0.7.6, =0.7.0a0, =0.22.0, =1.0.1, =4.2.0, =0.3.0, =0.6.0, =0.10.0a0, =0.10.0 Source cves: CVE-2026-102832 Source advisory: GHSA-JWRC-GM9J-263P...

datasetinsights (>=0.2.4, <=0.2.5), dotpack (>=0.3.0, <=0.3.6) +4 more potentially affected by CVE-2026-102832 via notebook (>=7.5.6, <=7.5.8)

notebook PYPI version =7.5.6, =0.2.4, =0.3.0, =0.0.1, =0.1.0, =0.1.6 Source cves: CVE-2026-102832 Source advisory: GHSA-JWRC-GM9J-263P...

datasetinsights (>=0.2.4, <=0.2.5), dotpack (>=0.3.0, <=0.3.6) +4 more potentially affected by CVE-2026-102832 via notebook (>=7.5.6, <=7.5.8)

notebook PYPI version =7.5.6, =0.2.4, =0.3.0, =0.0.1, =0.1.0, =0.1.6 Source cves: CVE-2026-102832 Source advisory: OSV:GHSA-JWRC-GM9J-263P...

ale-uy (1.5.0), datasetinsights (>=0.2.4, <=0.2.5) +7 more potentially affected by CVE-2026-102832 via jupyterlab (>=4.5.7, <=4.5.8)

jupyterlab PYPI version =4.5.7, =0.2.4, =0.0.1, =1.4.0, =0.1.0, =2.1.0, =2.1.2 Source cves: CVE-2026-102832 Source advisory: OSV:GHSA-JWRC-GM9J-263P...

jupyterlite-pyodide-kernel (>=0.7.0a0, <=0.7.2), jupyterlite-sphinx (>=0.22.0, <=0.22.1) +5 more potentially affected by CVE-2026-102832 via jupyterlite-core (>=0.7.6, <=0.8.0rc0)

jupyterlite-core PYPI version =0.7.6, =0.7.0a0, =0.22.0, =1.0.1, =4.2.0, =0.3.0, =0.6.0, =0.10.0a0, =0.10.0 Source cves: CVE-2026-102832 Source advisory: OSV:GHSA-JWRC-GM9J-263P...

cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +5 more potentially affected by CVE-2026-102832 via jupyterlab (>=4.6.0, <=4.6.2)

jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-102832 Source advisory: OSV:GHSA-JWRC-GM9J-263P...

ale-uy (1.5.0), datasetinsights (>=0.2.4, <=0.2.5) +7 more potentially affected by CVE-2026-102832 via jupyterlab (>=4.5.7, <=4.5.8)

jupyterlab PYPI version =4.5.7, =0.2.4, =0.0.1, =1.4.0, =0.1.0, =2.1.0, =2.1.2 Source cves: CVE-2026-102832 Source advisory: GHSA-JWRC-GM9J-263P...

cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +5 more potentially affected by CVE-2026-102832 via jupyterlab (>=4.6.0, <=4.6.2)

jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-102832 Source advisory: GHSA-JWRC-GM9J-263P...

@acampkin/mcc (>=2.1.0, <=2.5.0), @bsklaroff/yaac (>=0.0.1, <=0.0.6) +35 more potentially affected by CVE-2026-86063 via @anthropic-ai/claude-code (>=2.0.0, <=2.1.175)

@anthropic-ai/claude-code NPM version =2.0.0, =2.1.0, =0.0.1, =0.7.5, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.0.1, =0.4.0, =1.0.29, =0.12.0, =0.13.1 and more Source cves: CVE-2026-86063 Source advisory: GHSA-PQ7J-F95F-QFCV...

@acampkin/mcc (>=2.1.0, <=2.5.0), @bsklaroff/yaac (>=0.0.1, <=0.0.6) +35 more potentially affected by CVE-2026-86063 via @anthropic-ai/claude-code (>=2.0.0, <=2.1.175)

@anthropic-ai/claude-code NPM version =2.0.0, =2.1.0, =0.0.1, =0.7.5, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.0.1, =0.4.0, =1.0.29, =0.12.0, =0.13.1 and more Source cves: CVE-2026-86063 Source advisory: OSV:GHSA-PQ7J-F95F-QFCV...

@qwikui-org/ui (>=0.2.2, <=0.2.3), @react-portable/core (>=0.4.0, <=0.11.2) +1 more potentially affected by CVE-2026-84994 via @builder.io/qwik (>=1.2.6, <=1.4.5)

@builder.io/qwik NPM version =1.2.6, =0.2.2, =0.4.0, =0.11.2 - not-qwik-library-test1 0.0.3 Source cves: CVE-2026-84994 Source advisory: GHSA-X586-XVC8-G7Q6...

@qwikui-org/ui (>=0.2.2, <=0.2.3), @react-portable/core (>=0.4.0, <=0.11.2) +1 more potentially affected by CVE-2026-84994 via @builder.io/qwik (>=1.2.6, <=1.4.5)

@builder.io/qwik NPM version =1.2.6, =0.2.2, =0.4.0, =0.11.2 - not-qwik-library-test1 0.0.3 Source cves: CVE-2026-84994 Source advisory: OSV:GHSA-X586-XVC8-G7Q6...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +303 more potentially affected by CVE-2026-106495 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.2, =0.2.2 and more Source cves: CVE-2026-106495 Source advisory: OSV:GHSA-3XR5-8W6C-P5GW...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +303 more potentially affected by CVE-2026-106495 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.2, =0.2.2 and more Source cves: CVE-2026-106495 Source advisory: GHSA-3XR5-8W6C-P5GW...

@appium/base-driver (>=10.3.0, <=10.7.1), @appium/base-plugin (>=3.2.0, <=3.3.2) +19 more potentially affected by CVE-2026-103975 via @appium/support (>=7.1.0, <=7.2.5)

@appium/support NPM version =7.1.0, =10.3.0, =3.2.0, =2.3.0, =6.0.4, =4.2.0, =4.2.0, =1.1.0, =4.1.0, =2.1.4, =3.0.10, =1.0.0, =1.0.0, =2.107.37, =2.107.37, =2.136.0 - @silakagent/android-runner 0.1.0 and more Source cves: CVE-2026-103975 Source advisory: OSV:GHSA-QFXX-C367-67F8...