@semic/testing (2.2.11), @vendure/dashboard (>=3.2.2, <=3.4.4) potentially affected by CVE-2026-40887 via @vendure/core (>=3.0.0, <=3.4.4)

@vendure/core NPM version =3.0.0, =3.2.2, =3.4.4 Source cves: CVE-2026-40887 Source advisory: OSV:GHSA-9PP3-53P2-WW9V...

@semic/testing (2.2.11), @vendure/dashboard (>=3.2.2, <=3.4.4) potentially affected by CVE-2026-40887 via @vendure/core (>=3.0.0, <=3.4.4)

@vendure/core NPM version =3.0.0, =3.2.2, =3.4.4 Source cves: CVE-2026-40887 Source advisory: SNYK:JS-VENDURECORE-16068909...

@grupo-loja/vendure-banner-plugin (1.0.0), @grupo-loja/vendure-conect-envios-plugin (>=1.0.0, <=1.0.1) +54 more potentially affected by CVE-2026-40887 via @vendure/core (>=1.9.5, <=2.2.7)

@vendure/core NPM version =1.9.5, =1.0.0, =0.0.1, =1.0.3, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.2.4 and more Source cves: CVE-2026-40887 Source advisory: OSV:GHSA-9PP3-53P2-WW9V...

@grupo-loja/vendure-banner-plugin (1.0.0), @grupo-loja/vendure-conect-envios-plugin (>=1.0.0, <=1.0.1) +54 more potentially affected by CVE-2026-40887 via @vendure/core (>=1.9.5, <=2.2.7)

@vendure/core NPM version =1.9.5, =1.0.0, =0.0.1, =1.0.3, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.2.4 and more Source cves: CVE-2026-40887 Source advisory: SNYK:JS-VENDURECORE-16068909...

@toolsdk.ai/registry (1.0.83), easy-mcp-server (>=1.0.117, <=1.0.118) potentially affected by CVE-2026-39884 via mcp-server-kubernetes (>=2.4.3, <=2.9.9)

mcp-server-kubernetes NPM version =2.4.3, =1.0.117, =1.0.118 Source cves: CVE-2026-39884 Source advisory: SNYK:JS-MCPSERVERKUBERNETES-16083991...

2gis-maps (>=0.0.20, <=4.0.13), 2ndlogiccomponents (>=1.1.0, <=1.5.0) +3240 more potentially affected by CVE-2025-69993 via leaflet (>=0.5.1, <=2.0.0-alpha.1)

leaflet NPM version =0.5.1, =0.0.20, =1.1.0, =0.1.0, =0.1.0, =1.0.44, =1.0.55 - @ablogcms/background-process 3.2.28-beta.0 - @ablogcms/block-editor 3.2.28-beta.0 - @ablogcms/components 3.2.28-beta.0 - @ablogcms/dialog 3.2.28-beta.0 - @ablogcms/drawer 3.2.28-beta.0 - @ablogcms/kanban 3.2.28-beta.0...

de.digitalcollections:iiif-bookshelf-webapp (>=2.6.2, <=3.1.0), de.digitalcollections:iiif-server-demo (>=2.1.3, <=4.0.6) +25 more potentially affected by CVE-2025-69993 via org.webjars.npm:leaflet (>=0.7.7, <=2.0.0-alpha.1)

org.webjars.npm:leaflet MAVEN version =0.7.7, =2.6.2, =2.1.3, =0.9.0, =1.0.3, =2.0.0 - org.webjars.npm:github-com-cliffcloud-leaflet-easybutton 2.3.0 - org.webjars.npm:github-com-colorlibhq-gentelella- 4.0.0-rc.1 - org.webjars.npm:github-com-commenthol-leaflet-rastercoords 1.0.2 -...

@4via6/relay (>=1.0.0, <=1.1.3), @circleci/agents (>=1.0.6, <=2.3.1) +6 more potentially affected by CVE-2025-61260 via @openai/codex (>=0.1.2504211509, <=0.20.0)

@openai/codex NPM version =0.1.2504211509, =1.0.0, =1.0.6, =0.0.1, =0.23.0, =1.0.0, =0.0.1, =0.1.0, =1.0.0, =1.0.2 Source cves: CVE-2025-61260 Source advisory: SNYK:JS-OPENAICODEX-16111764...

@4via6/relay (>=1.0.0, <=1.1.3), @circleci/agents (>=1.0.6, <=2.3.1) +6 more potentially affected by CVE-2025-61260 via @openai/codex (>=0.1.2504211509, <=0.20.0)

@openai/codex NPM version =0.1.2504211509, =1.0.0, =1.0.6, =0.0.1, =0.23.0, =1.0.0, =0.0.1, =0.1.0, =1.0.0, =1.0.2 Source cves: CVE-2025-61260 Source advisory: OSV:GHSA-XRXF-JGV3-QMRM...

a11ywatch_cli (>=0.0.26, <=0.7.16), aap (>=0.4.0, <=0.4.1) +3696 more potentially affected by unknown CVE via rustls-webpki (>=0.100.3, <=0.102.8)

rustls-webpki CARGO version =0.100.3, =0.0.26, =0.4.0, =0.1.0, =0.21.0-alpha.1, =0.1.11, =0.12.1, =0.2.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0099...

a11ywatch_cli (>=0.0.26, <=0.7.16), aap (>=0.4.0, <=0.4.1) +3696 more potentially affected by unknown CVE via rustls-webpki (>=0.100.3, <=0.102.8)

rustls-webpki CARGO version =0.100.3, =0.0.26, =0.4.0, =0.1.0, =0.21.0-alpha.1, =0.1.11, =0.12.1, =0.2.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0098...

air-interpreter-cid (>=0.1.0, <=0.4.0), bellscoin (>=0.28.2, <=0.31.0) +47 more potentially affected by unknown CVE via core2 (>=0.3.3, <=0.4.0)

core2 CARGO version =0.3.3, =0.1.0, =0.28.2, =0.7.0, =2.3.0, =0.1.4, =0.3.0, =0.1.2, =2.1.0, =22.9.29 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0105...

com.argusoft:medplat_core (>=0.0.1, <=0.0.22), com.argusoft:medplat_lms (0.0.1) +1 more potentially affected by CVE-2026-23907 +1 more via org.apache.pdfbox:pdfbox-examples (2.0.21)

org.apache.pdfbox:pdfbox-examples MAVEN version 2.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pdfbox:pdfbox-examples and may be impacted: - com.argusoft:medplatcore =0.0.1, =0.0.1, =0.0.8 Source cves: CVE-2026-23907, CVE-2026-33929...

-lidonghui (1.0.0), -test-bitbucket-branch-manager (1.0.1) +60504 more potentially affected by CVE-2026-40895 via follow-redirects (>=1.0.0, <=1.15.11)

follow-redirects NPM version =1.0.0, =1.0.1, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.1 - 03-asenkronsdasdsadavehttprequest 1.0.0 - 04-17 1.0.0 - 04-17zy 1.0.0 - 04-a 1.0.0 and more Source cves: CVE-2026-40895 Source advisory: SNYK:JS-FOLLOWREDIRECTS-16032162...

-lidonghui (1.0.0), -test-bitbucket-branch-manager (1.0.1) +60504 more potentially affected by CVE-2026-40895 via follow-redirects (>=1.0.0, <=1.15.11)

follow-redirects NPM version =1.0.0, =1.0.1, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.1 - 03-asenkronsdasdsadavehttprequest 1.0.0 - 04-17 1.0.0 - 04-17zy 1.0.0 - 04-a 1.0.0 and more Source cves: CVE-2026-40895 Source advisory: OSV:GHSA-R4Q5-VMMM-2653...

a3mo_lib (>=0.1.0, <=0.1.1), abacuz (>=0.1.0, <=0.1.1) +10156 more potentially affected by unknown CVE via rand (>=0.7.0-pre.2, <=0.8.5)

rand CARGO version =0.7.0-pre.2, =0.1.0, =0.1.0, =0.1.0, =0.7.0, =0.2.0-beta.4, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.0.44, =0.0.5, =0.0.5, =0.0.14 and more Source cves: unknown CVE Source advisory: OSV:GHSA-CQ8V-F236-94QC...

dist_corr (>=0.1.0, <=0.1.1), mcproto (>=0.1.0, <=0.1.2) +4 more potentially affected by unknown CVE via rand (0.10.0-rc.8)

rand CARGO version 0.10.0-rc.8 is affected by a known vulnerability. The following packages have a transitive dependency on rand and may be impacted: - distcorr =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.5.7, =0.6.0 - randdistr 0.6.0-rc.0 Source cves: unknown CVE Source advisory: OSV:GHSA-CQ8V-F236-94QC...

auth_service_dhz (0.1.9), bin-proto (>=0.9.1, <=0.12.6) +9 more potentially affected by unknown CVE via rand (>=0.9.0, <=0.9.2)

rand CARGO version =0.9.0, =0.9.1, =0.1.0, =0.14.0, =0.1.0, =1.3.0, =2.1.0, =0.5.0-alpha.0, =0.8.6, =0.1.2, =0.3.3 Source cves: unknown CVE Source advisory: OSV:GHSA-CQ8V-F236-94QC...

@artur-abliazimov/othentic-cli (1.16.6), @darraghor/nest-backend-libs (>=3.8.8, <=5.0.11) +21 more potentially affected by CVE-2026-40879 via @nestjs/microservices (>=11.0.1, <=11.1.18)

@nestjs/microservices NPM version =11.0.1, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.0.0, =1.9.1, =1.16.9 and more Source cves: CVE-2026-40879 Source advisory: SNYK:JS-NESTJSMICROSERVICES-16082546...

@artur-abliazimov/othentic-cli (1.16.6), @darraghor/nest-backend-libs (>=3.8.8, <=5.0.11) +21 more potentially affected by CVE-2026-40879 via @nestjs/microservices (>=11.0.1, <=11.1.18)

@nestjs/microservices NPM version =11.0.1, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.0.0, =1.9.1, =1.16.9 and more Source cves: CVE-2026-40879 Source advisory: OSV:GHSA-HPWF-8G29-85QM...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.4), dbmodel (>=7.1.3-alpha.3, <=7.1.4) potentially affected by CVE-2026-6216 via dbgate-web (>=7.1.3-alpha.3, <=7.1.4-alpha.2)

dbgate-web NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.4 Source cves: CVE-2026-6216 Source advisory: OSV:GHSA-J8J5-7R4H-VJ2G...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.4), dbmodel (>=7.1.3-alpha.3, <=7.1.4) potentially affected by CVE-2026-6216 via dbgate-web (>=7.1.3-alpha.3, <=7.1.4-alpha.2)

dbgate-web NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.4 Source cves: CVE-2026-6216 Source advisory: SNYK:JS-DBGATEWEB-16083995...

coopihc-modelchecks (0.1.0), iperturb (0.2.0) potentially affected by CVE-2026-31048 via pyro (3.16.0)

pyro PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyro and may be impacted: - coopihc-modelchecks 0.1.0 - iperturb 0.2.0 Source cves: CVE-2026-31048 Source advisory: SNYK:PYTHON-PYRO-16428622...

3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +604 more potentially affected by CVE-2026-28291 via simple-git (>=3.0.3, <=3.31.1)

simple-git NPM version =3.0.3, =1.0.1, =1.0.1, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =23.0.0, =35.0.0, =1.4.0, =0.1.5-alpha.0, =1.0.2, =8.7.2, =39.0.2, =39.0.3 and more Source cves: CVE-2026-28291 Source advisory: OSV:GHSA-JCXM-M3JX-F287...

3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +604 more potentially affected by CVE-2022-25860 +1 more via simple-git (>=3.0.3, <=3.31.1)

simple-git NPM version =3.0.3, =1.0.1, =1.0.1, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =23.0.0, =35.0.0, =1.4.0, =0.1.5-alpha.0, =1.0.2, =8.7.2, =39.0.2, =39.0.3 and more Source cves: CVE-2022-25860, CVE-2026-28291 Source advisory: SNYK:JS-SIMPLEGIT-16032290...

org.webjars.npm:g-status (2.0.2), org.webjars.npm:graphql-toolkit__git-loader (0.7.5) potentially affected by CVE-2022-25860 +1 more via org.webjars.npm:simple-git (>=1.129.0, <=1.132.0)

org.webjars.npm:simple-git MAVEN version =1.129.0, =1.132.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:simple-git and may be impacted: - org.webjars.npm:g-status 2.0.2 - org.webjars.npm:graphql-toolkitgit-loader 0.7.5 Source cves:...

@algotech-ce/business (>=5.1.138, <=6.0.28), @braingrid/tools (1.1.0) +8 more potentially affected by unknown CVE via mathjs (>=15.0.0, <=15.1.1)

mathjs NPM version =15.0.0, =5.1.138, =1.0.0, =0.5.7, =0.0.0-alpha.0, =0.0.2, =0.0.6 Source cves: unknown CVE Source advisory: SNYK:JS-MATHJS-15989794...

@20syldev/api (>=2.6.0, <=2.8.0), @aalis/plugin-tool-math (>=0.1.0, <=0.9.1) +508 more potentially affected by CVE-2026-41139 via mathjs (>=13.1.0, <=15.1.1)

mathjs NPM version =13.1.0, =2.6.0, =0.1.0, =1.3.0, =2.0.0, =0.2.6, =0.3.0, =7.0.0, =7.0.0, =0.1.14, =0.13.1, =5.0.95, =1.0.0, =1.3.0-alpha.0 - @antsoo-lib/components 0.0.1 - @antsoo-lib/hooks 0.0.1 and more Source cves: CVE-2026-41139 Source advisory: OSV:GHSA-JVFF-X2QM-6286...

@unhead/angular (>=3.0.0-beta.1, <=3.0.0), @unhead/react (>=3.0.0-beta.1, <=3.0.0) +4 more potentially affected by unknown CVE via unhead (3.0.0-rc.4)

unhead NPM version 3.0.0-rc.4 is affected by a known vulnerability. The following packages have a transitive dependency on unhead and may be impacted: - @unhead/angular =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0 Source cves: unknown CVE Source...

@unhead/angular (>=3.0.0-beta.1, <=3.0.0), @unhead/react (>=3.0.0-beta.1, <=3.0.0) +4 more potentially affected by unknown CVE via unhead (3.0.0-rc.4)

unhead NPM version 3.0.0-rc.4 is affected by a known vulnerability. The following packages have a transitive dependency on unhead and may be impacted: - @unhead/angular =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0 Source cves: unknown CVE Source...

companies.sh (>=2026.324.0-canary.0, <=2026.325.0-canary.3), corporateai (2026.328.0-canary.0) +2 more potentially affected by CVE-2026-41679 via @paperclipai/server (>=2026.3.17-canary.3, <=2026.409.0-canary.4)

@paperclipai/server NPM version =2026.3.17-canary.3, =2026.324.0-canary.0, =2026.3.17-canary.3, =2026.409.0-canary.4 Source cves: CVE-2026-41679 Source advisory: OSV:GHSA-68QG-G8MG-6PR7...

companies.sh (>=2026.324.0-canary.0, <=2026.325.0-canary.3) potentially affected by CVE-2026-41679 via paperclipai (2026.324.0-canary.7)

paperclipai NPM version 2026.324.0-canary.7 is affected by a known vulnerability. The following packages have a transitive dependency on paperclipai and may be impacted: - companies.sh =2026.324.0-canary.0, =2026.325.0-canary.3 Source cves: CVE-2026-41679 Source advisory: OSV:GHSA-68QG-G8MG-6PR7...

0xgasless-mcp (>=1.0.3, <=1.0.5), 4d-vector-search (>=1.0.0, <=1.0.1) +3189 more potentially affected by CVE-2026-40190 via langsmith (>=0.0.5, <=0.5.4)

langsmith NPM version =0.0.5, =1.0.3, =1.0.0, =1.11.0, =0.0.5, =0.0.1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.6, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-40190 Source advisory: SNYK:JS-LANGSMITH-15969264...

@0xchain/empty (>=0.0.1, <=1.1.0-beta.4), @0xchain/expandable-text (>=0.0.1, <=1.1.0-beta.18) +16 more potentially affected by CVE-2026-40299 via next-intl (>=4.0.2, <=4.9.0)

next-intl NPM version =4.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.8.0, =1.28.0, =2.11.31, =0.0.3, =0.0.28 and more Source cves: CVE-2026-40299 Source advisory: SNYK:JS-NEXTINTL-15995498...

@0xchain/empty (>=0.0.1, <=1.1.0-beta.4), @0xchain/expandable-text (>=0.0.1, <=1.1.0-beta.18) +16 more potentially affected by CVE-2026-40299 via next-intl (>=4.0.2, <=4.9.0)

next-intl NPM version =4.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.8.0, =1.28.0, =2.11.31, =0.0.3, =0.0.28 and more Source cves: CVE-2026-40299 Source advisory: OSV:GHSA-8F24-V5VV-GM5J...

@activeboxes/piece-sftp (0.2.6), @activepieces/piece-apify (0.2.1) +24 more potentially affected by CVE-2026-39983 via basic-ftp (>=5.0.2, <=5.1.0)

basic-ftp NPM version =5.0.2, =0.2.6, =1.0.0, =1.0.0, =2.0.18, =1.9.2, =1.2.0, =4.6.0-blowfish, =1.0.3, =1.0.4, =0.1.1, =0.2.0 and more Source cves: CVE-2026-39983 Source advisory: SNYK:JS-BASICFTP-15989098...

@activeboxes/piece-sftp (0.2.6), @activepieces/piece-apify (0.2.1) +24 more potentially affected by unknown CVE via basic-ftp (>=5.0.2, <=5.1.0)

basic-ftp NPM version =5.0.2, =0.2.6, =1.0.0, =1.0.0, =2.0.18, =1.9.2, =1.2.0, =4.6.0-blowfish, =1.0.3, =1.0.4, =0.1.1, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-6V7Q-WJVX-W8WG...

0xgasless-mcp (>=1.0.3, <=1.0.5), 4d-vector-search (>=1.0.0, <=1.0.1) +3189 more potentially affected by CVE-2026-40190 via langsmith (>=0.0.5, <=0.5.4)

langsmith NPM version =0.0.5, =1.0.3, =1.0.0, =1.11.0, =0.0.5, =0.0.1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.6, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-40190 Source advisory: OSV:GHSA-FW9Q-39R9-C252...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +14708 more potentially affected by CVE-2026-40175 via axios (>=1.0.0, <=1.14.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-40175 Source advisory: SNYK:JS-AXIOS-15969258...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +14708 more potentially affected by CVE-2026-40175 via axios (>=1.0.0, <=1.14.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-40175 Source advisory: OSV:GHSA-FVCV-3M26-PCQX...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.3), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.3) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0, <=1.4.3)

@saltcorn/data NPM version =1.0.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-15991555...

@saltcorn/admin-models (>=1.5.0-beta.0, <=1.5.0), @saltcorn/base-plugin (>=1.5.0-beta.0, <=1.5.0) +5 more potentially affected by unknown CVE via @saltcorn/data (1.5.0-rc.2)

@saltcorn/data NPM version 1.5.0-rc.2 is affected by a known vulnerability. The following packages have a transitive dependency on @saltcorn/data and may be impacted: - @saltcorn/admin-models =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0,...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.3), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.3) potentially affected by unknown CVE via @saltcorn/server (>=1.0.0, <=1.4.3)

@saltcorn/server NPM version =1.0.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15991556...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.4), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.4) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0, <=1.4.4)

@saltcorn/data NPM version =1.0.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.4 Source cves: unknown CVE Source advisory: OSV:GHSA-59XV-588H-2VMM...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.0), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.0) potentially affected by unknown CVE via @saltcorn/server (1.5.0-rc.2)

@saltcorn/server NPM version 1.5.0-rc.2 is affected by a known vulnerability. The following packages have a transitive dependency on @saltcorn/server and may be impacted: - @saltcorn/cli =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15991556...

@saltcorn/admin-models (>=1.5.0-beta.0, <=1.5.4), @saltcorn/base-plugin (>=1.5.0-beta.0, <=1.5.4) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.5.0, <=1.5.4)

@saltcorn/data NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.4 Source cves: unknown CVE Source advisory: OSV:GHSA-59XV-588H-2VMM...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.4), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.0.0, <=1.4.4)

@saltcorn/server NPM version =1.0.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.4 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.4), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.0.0, <=1.4.4)

@saltcorn/server NPM version =1.0.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.4 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.4), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0, <=1.5.4)

@saltcorn/server NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.4 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.2), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.2) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0, <=1.5.2)

@saltcorn/server NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.2 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...