@grackle-ai/cli (>=0.0.2, <=0.70.3) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.3)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.3 Source cves: unknown CVE Source advisory: OSV:GHSA-3MJM-X6GW-2X42...

@grackle-ai/cli (>=0.0.2, <=0.70.4) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.4)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.4 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAISERVER-15840038...

@grackle-ai/cli (>=0.37.0, <=0.70.0), @grackle-ai/server (>=0.37.0, <=0.70.0) potentially affected by unknown CVE via @grackle-ai/powerline (>=0.37.0, <=0.70.0)

@grackle-ai/powerline NPM version =0.37.0, =0.37.0, =0.37.0, =0.70.0 Source cves: unknown CVE Source advisory: OSV:GHSA-XQ7H-VWJP-5VRH...

@grackle-ai/cli (>=0.37.0, <=0.70.0), @grackle-ai/server (>=0.37.0, <=0.70.0) potentially affected by unknown CVE via @grackle-ai/powerline (>=0.37.0, <=0.70.0)

@grackle-ai/powerline NPM version =0.37.0, =0.37.0, =0.37.0, =0.70.0 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIPOWERLINE-15871386...

@grackle-ai/cli (>=0.0.2, <=0.70.2) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.2)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.2 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAISERVER-15840352...

@grackle-ai/cli (>=0.0.2, <=0.70.2) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.2)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.2 Source cves: unknown CVE Source advisory: OSV:GHSA-W3HV-X4FP-6H6J...

@grackle-ai/cli (>=0.19.0, <=0.70.1), @grackle-ai/server (>=0.19.0, <=0.70.1) potentially affected by unknown CVE via @grackle-ai/mcp (>=0.19.0, <=0.70.1)

@grackle-ai/mcp NPM version =0.19.0, =0.19.0, =0.19.0, =0.70.1 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIMCP-15874101...

@grackle-ai/cli (>=0.19.0, <=0.70.1), @grackle-ai/server (>=0.19.0, <=0.70.1) potentially affected by unknown CVE via @grackle-ai/mcp (>=0.19.0, <=0.70.1)

@grackle-ai/mcp NPM version =0.19.0, =0.19.0, =0.19.0, =0.70.1 Source cves: unknown CVE Source advisory: OSV:GHSA-647H-P824-99W7...

@grackle-ai/cli (>=0.0.2, <=0.70.0) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.0)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.0 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAISERVER-15840033...

@grackle-ai/cli (>=0.0.2, <=0.70.0) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.0)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.0 Source cves: unknown CVE Source advisory: OSV:GHSA-7Q9X-8G6P-3X75...

@aokyra/baileys (2.0.6), @arceos/baileys (>=10.0.0, <=10.0.4) +73 more potentially affected by unknown CVE via @shennmine/libsignal-node (0.0.1-security)

@shennmine/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @shennmine/libsignal-node and may be impacted: - @aokyra/baileys 2.0.6 - @arceos/baileys =10.0.0, =2.0.3, =1.0.0, =1.0.0, =1.0.3, =1.0.6, =3.2.4, =2.1....

@aokyra/baileys (2.0.6), @arceos/baileys (>=10.0.0, <=10.0.4) +73 more potentially affected by unknown CVE via @shennmine/libsignal-node (0.0.1-security)

@shennmine/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @shennmine/libsignal-node and may be impacted: - @aokyra/baileys 2.0.6 - @arceos/baileys =10.0.0, =2.0.3, =1.0.0, =1.0.0, =1.0.3, =1.0.6, =3.2.4, =2.1....

@amqp-contract/asyncapi (>=0.2.0, <=0.20.0), @c15t/backend (>=1.1.0-canary.0, <=1.8.5) +13 more potentially affected by CVE-2026-33331 via @orpc/openapi (>=1.0.0-beta.1, <=1.13.8)

@orpc/openapi NPM version =1.0.0-beta.1, =0.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.0, =0.4.2, =1.0.0-beta.2, =0.0.0, =0.0.0, =1.0.0-beta.2, =1.0.0-beta.1, =1.2.0-canary.0, =1.8.5 Source cves: CVE-2026-33331 Sour...

@1771technologies/lytenyte-doc (1.0.13), @1771technologies/oneplay (>=0.0.1, <=0.0.6) +429 more potentially affected by CVE-2026-33769 via @astrojs/internal-helpers (>=0.0.0-markdoc-config-changes-20230626153541, <=0.7.5)

@astrojs/internal-helpers NPM version =0.0.0-markdoc-config-changes-20230626153541, =0.0.1, =1.0.0, =0.5.0, =1.0.0, =1.0.0, =0.0.17, =0.0.2, =0.2.0, =0.0.0-experimental-7c2f356, =0.0.0-experimental-7c2f356, =0.5.1 - @astro-sanctuary/toolbar-drupal 0.1.1 and more Source cves: CVE-2026-33769 Source...

@chainless-js/biometric-ed25519 (>=1.2.4, <=1.2.6), @forwardemail/wildduck (>=1.40.10, <=4.0.3) +17 more potentially affected by unknown CVE via fido2-lib (>=3.2.5, <=3.5.6)

fido2-lib NPM version =3.2.5, =1.2.4, =1.40.10, =8.0.1, =7.0.0, =5.8.38, =6.6.6, =0.0.2, =0.0.1, =1.0.0-alpha.1, =1.2.3, =6.0.0, =5.8.30, =1.46.1, =1.46.25 and more Source cves: unknown CVE Source advisory: OSV:GHSA-G3QJ-J598-CXMQ...

org.scala-sbt:sbt (>=0.99.2, <=1.0.0-m4), org.scala-sbt:scripted-plugin_2.10 (>=0.99.2, <=1.0.0-m4) +1 more potentially affected by CVE-2026-32948 via org.scala-sbt:main_2.11 (>=0.99.2, <=1.0.0-m4)

org.scala-sbt:main2.11 MAVEN version =0.99.2, =0.99.2, =0.99.2, =0.99.2, =1.0.0-m4 Source cves: CVE-2026-32948 Source advisory: SNYK:JAVA-ORGSCALASBT-15763414...

01os (>=0.0.1, <=0.0.13), 0din-litellm-shield (>=0.2.0, <=0.3.0) +3633 more potentially affected by unknown CVE via litellm (>=0.1.400, <=1.97.0rc1)

litellm PYPI version =0.1.400, =0.0.1, =0.2.0, =0.1.0, =0.1.0, =0.3.0, =0.0.13, =0.0.13, =0.1.3, =0.0.4, =0.1.0, =0.3.5, =0.1.1.dev1, =0.2.2, =0.2.1, =0.2.0, =0.6.1 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-LITELLM-15762713...

@brendonovich/solidjs__start (>=0.0.0, <=0.0.3), @h3ravel/arquebus (>=0.3.3, <=0.6.6) +43 more potentially affected by unknown CVE via h3 (2.0.0-rc.1)

h3 NPM version 2.0.0-rc.1 is affected by a known vulnerability. The following packages have a transitive dependency on h3 and may be impacted: - @brendonovich/solidjsstart =0.0.0, =0.3.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.24...

@brendonovich/solidjs__start (>=0.0.0, <=0.0.3), @h3ravel/arquebus (>=0.3.3, <=0.6.6) +43 more potentially affected by unknown CVE via h3 (2.0.0-rc.1)

h3 NPM version 2.0.0-rc.1 is affected by a known vulnerability. The following packages have a transitive dependency on h3 and may be impacted: - @brendonovich/solidjsstart =0.0.0, =0.3.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.24...

@amedia/brick-mcp (>=0.0.0-vBRAND-20260313141110, <=1.0.3), @andesite-lab/andesite-core (>=1.60.2, <=1.61.0) +338 more potentially affected by CVE-2026-3635 via fastify (>=5.0.0, <=5.8.2)

fastify NPM version =5.0.0, =0.0.0-vBRAND-20260313141110, =1.60.2, =2.0.1, =1.1.1, =0.6.2, =0.1.1, =0.1.1, =0.6.0, =0.1.1, =0.0.35, =0.0.82, =0.0.1, =0.0.6, =0.1.68, =0.1.130 and more Source cves: CVE-2026-3635 Source advisory: SNYK:JS-FASTIFY-15762220...

@atomicservice/ascf-toolkit (>=1.0.0, <=1.0.17), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.17) +77 more potentially affected by CVE-2026-4602 via jsrsasign (>=11.0.0, <=11.1.0)

jsrsasign NPM version =11.0.0, =1.0.0, =1.0.1-beta.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.8.3 - @citrineos/ocpi-base 2.0.1 - @citrineos/ocpi-cdrs 2.0.1 - @citrineos/ocpi-charging-profiles 2.0.1 - @citrineos/ocpi-commands 2.0.1 - @citrineos/ocpi-credentials 2.0.1 - @citrineos/ocpi-locations 2.0.1 -...

@atomicservice/ascf-toolkit (>=1.0.0, <=1.0.17), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.17) +77 more potentially affected by CVE-2026-4598 via jsrsasign (>=11.0.0, <=11.1.0)

jsrsasign NPM version =11.0.0, =1.0.0, =1.0.1-beta.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.8.3 - @citrineos/ocpi-base 2.0.1 - @citrineos/ocpi-cdrs 2.0.1 - @citrineos/ocpi-charging-profiles 2.0.1 - @citrineos/ocpi-commands 2.0.1 - @citrineos/ocpi-credentials 2.0.1 - @citrineos/ocpi-locations 2.0.1 -...

@atomicservice/ascf-toolkit (>=1.0.0, <=1.0.17), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.17) +77 more potentially affected by CVE-2026-4600 via jsrsasign (>=11.0.0, <=11.1.0)

jsrsasign NPM version =11.0.0, =1.0.0, =1.0.1-beta.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.8.3 - @citrineos/ocpi-base 2.0.1 - @citrineos/ocpi-cdrs 2.0.1 - @citrineos/ocpi-charging-profiles 2.0.1 - @citrineos/ocpi-commands 2.0.1 - @citrineos/ocpi-credentials 2.0.1 - @citrineos/ocpi-locations 2.0.1 -...

@atomicservice/ascf-toolkit (>=1.0.0, <=1.0.17), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.17) +77 more potentially affected by CVE-2026-4603 via jsrsasign (>=11.0.0, <=11.1.0)

jsrsasign NPM version =11.0.0, =1.0.0, =1.0.1-beta.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.8.3 - @citrineos/ocpi-base 2.0.1 - @citrineos/ocpi-cdrs 2.0.1 - @citrineos/ocpi-charging-profiles 2.0.1 - @citrineos/ocpi-commands 2.0.1 - @citrineos/ocpi-credentials 2.0.1 - @citrineos/ocpi-locations 2.0.1 -...

@atomicservice/ascf-toolkit (>=1.0.0, <=1.0.17), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.17) +77 more potentially affected by CVE-2026-4601 via jsrsasign (>=11.0.0, <=11.1.0)

jsrsasign NPM version =11.0.0, =1.0.0, =1.0.1-beta.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.8.3 - @citrineos/ocpi-base 2.0.1 - @citrineos/ocpi-cdrs 2.0.1 - @citrineos/ocpi-charging-profiles 2.0.1 - @citrineos/ocpi-commands 2.0.1 - @citrineos/ocpi-credentials 2.0.1 - @citrineos/ocpi-locations 2.0.1 -...

@0x5e/react-native-alipay (>=0.2.2, <=0.2.7-beta.2), @10yun/cv-mobile-ui (0.3.20) +1786 more potentially affected by CVE-2026-4599 via jsrsasign (>=7.1.2, <=11.1.0)

jsrsasign NPM version =7.1.2, =0.2.2, =0.0.0-alpha.0, =0.7.6, =0.7.6, =0.0.83, =0.7.6, =0.7.6, =0.9.0, =0.7.6, =0.7.6, =0.7.6, =0.3.4, =0.3.4, =0.3.4, =0.8.0 and more Source cves: CVE-2026-4599 Source advisory: OSV:GHSA-5JX8-Q4CP-RHH6...

21cmpsdenoiser (>=1.0.0, <=1.0.2), 2404-segmentation-pipeline (>=0.1.0, <=1.0.0) +27529 more potentially affected by CVE-2026-4538 via torch (>=1.0.0, <=2.13.0)

torch PYPI version =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.10.5, =0.10.13 and more Source cves: CVE-2026-4538 Source advisory: SNYK:PYTHON-TORCH-15746467...

cy-ai-trainer (>=0.0.1, <=0.0.2), llama-index-packs-vanna (>=0.0.1, <=0.3.0) +2 more potentially affected by CVE-2026-4513 via vanna (>=0.0.30, <=2.0.2)

vanna PYPI version =0.0.30, =0.0.1, =0.0.1, =1.4.0a20260123, =1.0.0, =2.0.0 Source cves: CVE-2026-4513 Source advisory: SNYK:PYTHON-VANNA-15756488...

cy-ai-trainer (>=0.0.1, <=0.0.2), llama-index-packs-vanna (>=0.0.1, <=0.3.0) +2 more potentially affected by CVE-2026-4511 via vanna (>=0.0.30, <=2.0.2)

vanna PYPI version =0.0.30, =0.0.1, =0.0.1, =1.4.0a20260123, =1.0.0, =2.0.0 Source cves: CVE-2026-4511 Source advisory: SNYK:PYTHON-VANNA-15756186...

webpki-roots (>=0.26.0-alpha.0, <=0.26.0-alpha.1) potentially affected by unknown CVE via rustls-webpki (0.102.8)

rustls-webpki CARGO version 0.102.8 is affected by a known vulnerability. The following packages have a transitive dependency on rustls-webpki and may be impacted: - webpki-roots =0.26.0-alpha.0, =0.26.0-alpha.1 Source cves: unknown CVE Source advisory: OSV:GHSA-PWJX-QHCG-RVJ4...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +213 more potentially affected by unknown CVE via h3 (>=1.0.1, <=1.15.6)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-H3-15746329...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +213 more potentially affected by unknown CVE via h3 (>=1.0.1, <=1.15.6)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-4HXC-9384-M385...

@brendonovich/solidjs__start (>=0.0.0, <=0.0.3), @h3ravel/arquebus (>=0.3.3, <=0.6.6) +43 more potentially affected by unknown CVE via h3 (2.0.0-rc.1)

h3 NPM version 2.0.0-rc.1 is affected by a known vulnerability. The following packages have a transitive dependency on h3 and may be impacted: - @brendonovich/solidjsstart =0.0.0, =0.3.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.24...

@brendonovich/solidjs__start (>=0.0.0, <=0.0.3), @h3ravel/arquebus (>=0.3.3, <=0.6.6) +43 more potentially affected by unknown CVE via h3 (2.0.0-rc.1)

h3 NPM version 2.0.0-rc.1 is affected by a known vulnerability. The following packages have a transitive dependency on h3 and may be impacted: - @brendonovich/solidjsstart =0.0.0, =0.3.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.24...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +213 more potentially affected by unknown CVE via h3 (>=1.0.1, <=1.15.6)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-72GR-QFP7-VWHW...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +213 more potentially affected by unknown CVE via h3 (>=1.0.1, <=1.15.6)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-H3-15745711...

@abiswas97/postgres-mcp (2.0.0), @ampt/sql (1.0.1) +743 more potentially affected by CVE-2026-33468 via kysely (>=0.3.9, <=0.28.13)

kysely NPM version =0.3.9, =1.0.25-beta.0, =0.0.19, =1.2.6-beta.2, =0.0.1, =0.0.0, =0.1.0, =0.0.2, =0.0.1, =2.7.6, =0.2.0, =11.3.0 and more Source cves: CVE-2026-33468 Source advisory: OSV:GHSA-8CPQ-38P9-67GX...

@abiswas97/postgres-mcp (2.0.0), @ampt/sql (1.0.1) +743 more potentially affected by CVE-2026-33468 via kysely (>=0.3.9, <=0.28.13)

kysely NPM version =0.3.9, =1.0.25-beta.0, =0.0.19, =1.2.6-beta.2, =0.0.1, =0.0.0, =0.1.0, =0.0.2, =0.0.1, =2.7.6, =0.2.0, =11.3.0 and more Source cves: CVE-2026-33468 Source advisory: SNYK:JS-KYSELY-15763566...

@mikro-orm/entity-generator (>=7.0.2-dev.17, <=7.0.5-dev.1), @mikro-orm/libsql (>=7.0.2-dev.17, <=7.0.5-dev.1) +11 more potentially affected by CVE-2026-33442 via kysely (>=0.28.12, <=0.28.13)

kysely NPM version =0.28.12, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.5-dev.1 - @omnitron-dev/omnitron 0.1.3 - @omnitron-dev/testing 0.1.3 - @omnitron-dev/titan-database 0.1.3 Source...

@mikro-orm/entity-generator (>=7.0.2-dev.17, <=7.0.5-dev.1), @mikro-orm/libsql (>=7.0.2-dev.17, <=7.0.5-dev.1) +11 more potentially affected by CVE-2026-33442 via kysely (>=0.28.12, <=0.28.13)

kysely NPM version =0.28.12, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.5-dev.1 - @omnitron-dev/omnitron 0.1.3 - @omnitron-dev/testing 0.1.3 - @omnitron-dev/titan-database 0.1.3 Source...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by unknown CVE via @pdfme/common (5.5.8)

@pdfme/common NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/common and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: unknown CVE Source advisory: OSV:GHSA-PGX6-7JCQ-2QFF...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by unknown CVE via @pdfme/common (5.5.8)

@pdfme/common NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/common and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: unknown CVE Source advisory: SNYK:JS-PDFMECOMMON-15746945...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by unknown CVE via @pdfme/schemas (5.5.8)

@pdfme/schemas NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: unknown CVE Source advisory: OSV:GHSA-XGX4-2WGV-4JHM...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by unknown CVE via @pdfme/schemas (5.5.8)

@pdfme/schemas NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: unknown CVE Source advisory: SNYK:JS-PDFMESCHEMAS-15746947...

dicebear (>=9.0.0, <=9.4.1) potentially affected by CVE-2026-33418 via @dicebear/converter (>=9.0.0, <=9.4.1)

@dicebear/converter NPM version =9.0.0, =9.0.0, =9.4.1 Source cves: CVE-2026-33418 Source advisory: SNYK:JS-DICEBEARCONVERTER-15746952...

dicebear (>=9.0.0, <=9.4.1) potentially affected by CVE-2026-33418 via @dicebear/converter (>=9.0.0, <=9.4.1)

@dicebear/converter NPM version =9.0.0, =9.0.0, =9.4.1 Source cves: CVE-2026-33418 Source advisory: OSV:GHSA-7J2X-32W6-P43P...

jsonwebtoken-aws-lc (9.3.0), jwts (>=0.5.0, <=0.5.1) +2 more potentially affected by CVE-2026-4428 via aws-lc-sys (0.21.0)

aws-lc-sys CARGO version 0.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on aws-lc-sys and may be impacted: - jsonwebtoken-aws-lc 9.3.0 - jwts =0.5.0, =0.102.6, =0.27.0, =0.31.0 Source cves: CVE-2026-4428 Source advisory: OSV:GHSA-9F94-5G5W-GF6R...

@2digits/tlo-mcp (>=0.1.0, <=0.1.10), @6qat/tcp-connection (>=0.2.6, <=0.2.9) +727 more potentially affected by CVE-2026-32887 via effect (>=3.0.0, <=3.19.19)

effect NPM version =3.0.0, =0.1.0, =0.2.6, =1.0.0, =0.1.0-alpha.1, =0.0.1, =0.1.0-alpha.1, =0.1.1, =0.0.1, =0.0.5, =0.0.1, =0.2.1, =0.4.2 - @arvkonstantin/framework-provider-local-pg 3.4.3 - @awstin/effect-zero-v3 0.1.0 and more Source cves: CVE-2026-32887 Source advisory: SNYK:JS-EFFECT-15746380...

@2digits/tlo-mcp (>=0.1.0, <=0.1.10), @6qat/tcp-connection (>=0.2.6, <=0.2.9) +727 more potentially affected by CVE-2026-32887 via effect (>=3.0.0, <=3.19.19)

effect NPM version =3.0.0, =0.1.0, =0.2.6, =1.0.0, =0.1.0-alpha.1, =0.0.1, =0.1.0-alpha.1, =0.1.1, =0.0.1, =0.0.5, =0.0.1, =0.2.1, =0.4.2 - @arvkonstantin/framework-provider-local-pg 3.4.3 - @awstin/effect-zero-v3 0.1.0 and more Source cves: CVE-2026-32887 Source advisory: OSV:GHSA-38F7-945M-QR2G...

@amqp-contract/asyncapi (>=0.2.0, <=0.20.0), @c15t/backend (>=1.1.0-canary.0, <=1.8.5) +13 more potentially affected by CVE-2026-33331 via @orpc/openapi (>=1.0.0-beta.1, <=1.13.8)

@orpc/openapi NPM version =1.0.0-beta.1, =0.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.0, =0.4.2, =1.0.0-beta.2, =0.0.0, =0.0.0, =1.0.0-beta.2, =1.0.0-beta.1, =1.2.0-canary.0, =1.8.5 Source cves: CVE-2026-33331 Sour...