@apollo/gateway (>=2.10.0-alpha.0, <=2.10.4), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.10.0, <=2.10.4)

@apollo/query-planner NPM version =2.10.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.4), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.10.0, <=2.10.4)

@apollo/query-planner NPM version =2.10.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@lenne.tech/nest-server (>=11.1.14, <=11.2.0) potentially affected by CVE-2026-32621 via @apollo/gateway (>=2.11.2, <=2.11.3)

@apollo/gateway NPM version =2.11.2, =11.1.14, =11.2.0 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOGATEWAY-15612461...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.5), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.3.0, <=2.9.5)

@apollo/query-planner NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2066 more potentially affected by CVE-2026-1526 via undici (>=6.0.0, <=6.23.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =0.5.21-beta.0, =0.5.43 and more Source cves: CVE-2026-1526 Source advisory: OSV:GHSA-VRM6-8VPV-QV8Q...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +465 more potentially affected by CVE-2026-1526 via undici (>=7.0.0, <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =1.0.1-dev.120, =0.1.0, =12.6.9, =13.0.0-alpha.4 and more Source cves: CVE-2026-1526 Source advisory: OSV:GHSA-VRM6-8VPV-QV8Q...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +465 more potentially affected by CVE-2026-2229 via undici (>=7.0.0, <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =1.0.1-dev.120, =0.1.0, =12.6.9, =13.0.0-alpha.4 and more Source cves: CVE-2026-2229 Source advisory: OSV:GHSA-V9P9-HFJ2-HCW8...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2066 more potentially affected by CVE-2026-2229 via undici (>=6.0.0, <=6.23.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =0.5.21-beta.0, =0.5.43 and more Source cves: CVE-2026-2229 Source advisory: OSV:GHSA-V9P9-HFJ2-HCW8...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2066 more potentially affected by CVE-2026-1527 via undici (>=6.0.0, <=6.23.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =0.5.21-beta.0, =0.5.43 and more Source cves: CVE-2026-1527 Source advisory: OSV:GHSA-4992-7RV2-5PVQ...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +465 more potentially affected by CVE-2026-1527 via undici (>=7.0.0, <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =1.0.1-dev.120, =0.1.0, =12.6.9, =13.0.0-alpha.4 and more Source cves: CVE-2026-1527 Source advisory: OSV:GHSA-4992-7RV2-5PVQ...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.1.0-dev.260119.0a66443, <=0.3.0) +188 more potentially affected by CVE-2026-2581 via undici (>=7.18.0, <=7.22.0)

undici NPM version =7.18.0, =0.1.1, =0.1.0-dev.260119.0a66443, =0.1.3, =21.1.0-rc.0, =21.1.0-rc.0, =2.8.1, =1.0.1-beta.0, =2026.1.14, =0.13.100, =1.21.1, =0.12.5, =1.2.2, =21.2.2-depup.0, =21.2.3-depup.1 - @depup/directus 11.16.1-depup.0 and more Source cves: CVE-2026-2581 Source advisory:...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2066 more potentially affected by CVE-2026-1528 via undici (>=6.0.0, <=6.23.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =0.5.21-beta.0, =0.5.43 and more Source cves: CVE-2026-1528 Source advisory: OSV:GHSA-F269-VFMQ-VJVJ...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +465 more potentially affected by CVE-2026-1528 via undici (>=7.0.0, <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =1.0.1-dev.120, =0.1.0, =12.6.9, =13.0.0-alpha.4 and more Source cves: CVE-2026-1528 Source advisory: OSV:GHSA-F269-VFMQ-VJVJ...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +465 more potentially affected by CVE-2026-1525 via undici (>=7.0.0, <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =1.0.1-dev.120, =0.1.0, =12.6.9, =13.0.0-alpha.4 and more Source cves: CVE-2026-1525 Source advisory: OSV:GHSA-2MJP-6Q6P-2QXM...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2066 more potentially affected by CVE-2026-1525 via undici (>=6.0.0, <=6.23.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =0.5.21-beta.0, =0.5.43 and more Source cves: CVE-2026-1525 Source advisory: OSV:GHSA-2MJP-6Q6P-2QXM...

@oneuptime/cli (>=10.0.5, <=10.0.23) potentially affected by CVE-2026-32598 via @oneuptime/common (>=10.0.5, <=10.0.23)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.23 Source cves: CVE-2026-32598 Source advisory: SNYK:JS-ONEUPTIMECOMMON-15669612...

blake-streams (0.1.0), cs_mwc-libp2p (0.35.3) +40 more potentially affected by CVE-2026-32314 via yamux (>=0.1.9, <=0.10.2)

yamux CARGO version =0.1.9, =0.20.0, =2.0.0-alpha.3, =0.4.0, =0.2.0, =0.20.0, =0.36.0, =0.16.0, =0.1.0, =0.1.1, =0.15.0, =0.19.1 and more Source cves: CVE-2026-32314 Source advisory: OSV:GHSA-VXX9-2994-Q338...

@oneuptime/cli (>=10.0.5, <=10.0.22) potentially affected by CVE-2026-32308 via @oneuptime/common (>=10.0.5, <=10.0.22)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.22 Source cves: CVE-2026-32308 Source advisory: SNYK:JS-ONEUPTIMECOMMON-15669623...

@oneuptime/cli (>=10.0.5, <=10.0.22) potentially affected by CVE-2026-32306 via @oneuptime/common (>=10.0.5, <=10.0.22)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.22 Source cves: CVE-2026-32306 Source advisory: SNYK:JS-ONEUPTIMECOMMON-15669899...

@alfresco/adf-testing (6.0.0-A.2-8258), @algolia/coquille (>=0.0.2, <=0.0.13) +361 more potentially affected by CVE-2026-32141 via flatted (>=3.0.1, <=3.3.4)

flatted NPM version =3.0.1, =0.0.2, =1.1.0, =1.0.0, =1.0.0, =0.0.10, =0.0.11, =0.0.4, =1.0.0, =1.0.0, =0.0.20, =0.0.19, =1.2.2, =1.5.8 and more Source cves: CVE-2026-32141 Source advisory: OSV:GHSA-25H7-PFQ9-P65F...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @mieweb/wikigdrive (>=2.15.0, <=2.17.1) +3 more potentially affected by CVE-2026-26954 via @nyariv/sandboxjs (>=0.5.3, <=0.8.25)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =2.15.0, =0.2.0, =11.0.0, =12.0.1 Source cves: CVE-2026-26954 Source advisory: SNYK:JS-NYARIVSANDBOXJS-15518695...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @mieweb/wikigdrive (>=2.15.0, <=2.17.1) +3 more potentially affected by CVE-2026-26954 via @nyariv/sandboxjs (>=0.5.3, <=0.8.25)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =2.15.0, =0.2.0, =11.0.0, =12.0.1 Source cves: CVE-2026-26954 Source advisory: OSV:GHSA-6R9F-759J-HJGV...

org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-1526 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2066 more potentially affected by CVE-2026-1526 via undici (>=6.0.0, <=6.23.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =0.5.21-beta.0, =0.5.43 and more Source cves: CVE-2026-1526 Source advisory: SNYK:JS-UNDICI-15518068...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +465 more potentially affected by CVE-2026-1526 via undici (>=7.0.0, <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =1.0.1-dev.120, =0.1.0, =12.6.9, =13.0.0-alpha.4 and more Source cves: CVE-2026-1526 Source advisory: SNYK:JS-UNDICI-15518068...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +465 more potentially affected by CVE-2026-2229 via undici (>=7.0.0, <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =1.0.1-dev.120, =0.1.0, =12.6.9, =13.0.0-alpha.4 and more Source cves: CVE-2026-2229 Source advisory: SNYK:JS-UNDICI-15518070...

org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-2229 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2066 more potentially affected by CVE-2026-2229 via undici (>=6.0.0, <=6.23.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =0.5.21-beta.0, =0.5.43 and more Source cves: CVE-2026-2229 Source advisory: SNYK:JS-UNDICI-15518070...

org.webjars.npm:file-entry-cache (>=5.0.1, <=6.0.1), org.webjars.npm:flat-cache (>=2.0.1, <=3.0.4) +6 more potentially affected by CVE-2026-32141 via org.webjars.npm:flatted (>=2.0.1, <=3.3.4)

org.webjars.npm:flatted MAVEN version =2.0.1, =5.0.1, =2.0.1, =3.3.1, =0.3.16, =0.2.107, =1.1.13, =0.1.30, =1.7.6, =2.0.2 Source cves: CVE-2026-32141 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15518042...

@alfresco/adf-testing (6.0.0-A.2-8258), @algolia/coquille (>=0.0.2, <=0.0.13) +361 more potentially affected by CVE-2026-32141 via flatted (>=3.0.1, <=3.3.4)

flatted NPM version =3.0.1, =0.0.2, =1.1.0, =1.0.0, =1.0.0, =0.0.10, =0.0.11, =0.0.4, =1.0.0, =1.0.0, =0.0.20, =0.0.19, =1.2.2, =1.5.8 and more Source cves: CVE-2026-32141 Source advisory: SNYK:JS-FLATTED-15518041...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +465 more potentially affected by CVE-2026-1528 via undici (>=7.0.0, <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =1.0.1-dev.120, =0.1.0, =12.6.9, =13.0.0-alpha.4 and more Source cves: CVE-2026-1528 Source advisory: SNYK:JS-UNDICI-15518064...

org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-1528 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2066 more potentially affected by CVE-2026-1528 via undici (>=6.0.0, <=6.23.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =0.5.21-beta.0, =0.5.43 and more Source cves: CVE-2026-1528 Source advisory: SNYK:JS-UNDICI-15518064...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2066 more potentially affected by CVE-2026-1527 via undici (>=6.0.0, <=6.23.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =0.5.21-beta.0, =0.5.43 and more Source cves: CVE-2026-1527 Source advisory: SNYK:JS-UNDICI-15518072...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +465 more potentially affected by CVE-2026-1527 via undici (>=7.0.0, <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =1.0.1-dev.120, =0.1.0, =12.6.9, =13.0.0-alpha.4 and more Source cves: CVE-2026-1527 Source advisory: SNYK:JS-UNDICI-15518072...

org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-1527 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.1.0-dev.260119.0a66443, <=0.3.0) +188 more potentially affected by CVE-2026-2581 via undici (>=7.18.0, <=7.22.0)

undici NPM version =7.18.0, =0.1.1, =0.1.0-dev.260119.0a66443, =0.1.3, =21.1.0-rc.0, =21.1.0-rc.0, =2.8.1, =1.0.1-beta.0, =2026.1.14, =0.13.100, =1.21.1, =0.12.5, =1.2.2, =21.2.2-depup.0, =21.2.3-depup.1 - @depup/directus 11.16.1-depup.0 and more Source cves: CVE-2026-2581 Source advisory:...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2066 more potentially affected by CVE-2026-1525 via undici (>=6.0.0, <=6.23.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =0.5.21-beta.0, =0.5.43 and more Source cves: CVE-2026-1525 Source advisory: SNYK:JS-UNDICI-15518061...

org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-1525 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +465 more potentially affected by CVE-2026-1525 via undici (>=7.0.0, <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =1.0.1-dev.120, =0.1.0, =12.6.9, =13.0.0-alpha.4 and more Source cves: CVE-2026-1525 Source advisory: SNYK:JS-UNDICI-15518061...

@tinacms/app (>=0.0.0-0b7103c-20251216023146, <=2.3.24), @tinacms/cli (>=0.0.0-0b7103c-20251216023146, <=2.1.5) +4 more potentially affected by CVE-2026-24125 via @tinacms/graphql (>=2.0.0, <=2.1.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =3.4.1 Source cves: CVE-2026-24125 Source advisory: SNYK:JS-TINACMSGRAPHQL-15518060...

@tinacms/app (>=0.0.0-00aadfd-20260223215804, <=2.3.26), @tinacms/cli (>=0.0.0-00aadfd-20260223215804, <=2.1.7) +7 more potentially affected by CVE-2026-29066 via @tinacms/schema-tools (>=2.0.0, <=2.6.0)

@tinacms/schema-tools NPM version =2.0.0, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =2.0.0, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804,...

@tinacms/app (>=0.0.0-00aadfd-20260223215804, <=2.3.26), @tinacms/cli (>=0.0.0-00aadfd-20260223215804, <=2.1.7) +7 more potentially affected by CVE-2026-28792 via @tinacms/schema-tools (>=2.0.0, <=2.6.0)

@tinacms/schema-tools NPM version =2.0.0, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =2.0.0, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804,...

@tinacms/app (>=0.0.0-20240725232152, <=2.0.3), @tinacms/cli (>=0.0.0-20240725232152, <=1.5.53) +1 more potentially affected by CVE-2026-28791 via tinacms (>=2.0.0, <=2.1.1)

tinacms NPM version =2.0.0, =0.0.0-20240725232152, =0.0.0-20240725232152, =0.0.35, =0.0.37 Source cves: CVE-2026-28791 Source advisory: OSV:GHSA-5HXF-C7J4-279C...

@tinacms/app (>=0.0.0-0b7103c-20251216023146, <=2.3.25), @tinacms/cli (>=0.0.0-0b7103c-20251216023146, <=2.1.6) +4 more potentially affected by CVE-2026-28791 via @tinacms/graphql (>=2.0.0, <=2.1.2)

@tinacms/graphql NPM version =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =3.5.0 Source cves: CVE-2026-28791 Source advisory: SNYK:JS-TINACMSGRAPHQL-15518326...

@tinacms/app (>=0.0.0-0b7103c-20251216023146, <=2.3.24), @tinacms/cli (>=0.0.0-0b7103c-20251216023146, <=2.1.5) +4 more potentially affected by CVE-2026-24125 via @tinacms/graphql (>=2.0.0, <=2.1.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =3.4.1 Source cves: CVE-2026-24125 Source advisory: OSV:GHSA-2238-XC5R-V9HJ...

@burger-editor/blocks (>=4.0.0-alpha.1, <=4.0.0-alpha.7), @burger-editor/client (>=4.0.0-alpha.1, <=4.0.0-alpha.7) +4 more potentially affected by unknown CVE via trix (>=2.0.8, <=2.1.15)

trix NPM version =2.0.8, =4.0.0-alpha.1, =4.0.0-alpha.1, =4.0.0-alpha.1, =4.0.0-alpha.5, =4.0.0-alpha.1, =1.0.1, =1.0.3 Source cves: unknown CVE Source advisory: SNYK:JS-TRIX-15481278...

@burger-editor/blocks (>=4.0.0-alpha.1, <=4.0.0-alpha.7), @burger-editor/client (>=4.0.0-alpha.1, <=4.0.0-alpha.7) +4 more potentially affected by CVE-2026-73426 via trix (>=2.0.8, <=2.1.15)

trix NPM version =2.0.8, =4.0.0-alpha.1, =4.0.0-alpha.1, =4.0.0-alpha.1, =4.0.0-alpha.5, =4.0.0-alpha.1, =1.0.1, =1.0.3 Source cves: CVE-2026-73426 Source advisory: OSV:GHSA-QMPG-8XG6-PH5Q...

@deno/sandbox (>=0.0.9, <=0.6.0), @ekairos/cli (>=1.22.35, <=1.22.106-beta.feature-context-event-reaction-architecture.0) +64 more potentially affected by unknown CVE via devalue (>=5.0.0, <=5.6.3)

devalue NPM version =5.0.0, =0.0.9, =1.22.35, =1.22.102-beta.feature-lab-task-sandbox-beta.0, =1.21.52-beta.0, =1.22.4-beta.development.0, =1.22.13-beta.development.0, =1.22.39, =1.22.11-beta.development.0, =1.21.56-beta.0, =1.21.53-beta.0, =1.22.35, =1.21.88-beta.0, =0.0.0-dev-20260121145510,...

@aabelmann/ui-layer (0.0.1), @adinvadim/convex-vue (>=1.1.0, <=1.3.0) +719 more potentially affected by unknown CVE via devalue (>=4.0.1, <=5.6.3)

devalue NPM version =4.0.1, =1.1.0, =1.0.0, =0.2.2, =0.2.2, =0.2.2, =0.3.0, =0.5.7, =0.0.1-beta.3, =0.0.1-alpha.1, =0.0.17, =0.0.2, =0.0.1, =0.2.0 - @astro-component/button 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MWV9-GP5H-FRR4...