cy-ai-trainer (>=0.0.1, <=0.0.2), llama-index-packs-vanna (>=0.0.1, <=0.3.0) +2 more potentially affected by CVE-2026-4511 via vanna (>=0.0.30, <=2.0.2)

vanna PYPI version =0.0.30, =0.0.1, =0.0.1, =1.4.2, =1.0.0, =2.0.0 Source cves: CVE-2026-4511 Source advisory: SNYK:PYTHON-VANNA-15756186...

webpki-roots (>=0.26.0-alpha.0, <=0.26.0-alpha.1) potentially affected by unknown CVE via rustls-webpki (0.102.8)

rustls-webpki CARGO version 0.102.8 is affected by a known vulnerability. The following packages have a transitive dependency on rustls-webpki and may be impacted: - webpki-roots =0.26.0-alpha.0, =0.26.0-alpha.1 Source cves: unknown CVE Source advisory: OSV:GHSA-PWJX-QHCG-RVJ4...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +220 more potentially affected by unknown CVE via h3 (>=1.0.1, <=1.15.6)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-H3-15746329...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +220 more potentially affected by CVE-2026-86252 via h3 (>=1.0.1, <=1.15.6)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: CVE-2026-86252 Source advisory: OSV:GHSA-4HXC-9384-M385...

@brendonovich/solidjs__start (>=0.0.0, <=0.0.3), @h3ravel/arquebus (>=0.3.3, <=0.6.6) +43 more potentially affected by CVE-2026-86252 via h3 (2.0.0-rc.1)

h3 NPM version 2.0.0-rc.1 is affected by a known vulnerability. The following packages have a transitive dependency on h3 and may be impacted: - @brendonovich/solidjsstart =0.0.0, =0.3.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.24...

@brendonovich/solidjs__start (>=0.0.0, <=0.0.3), @h3ravel/arquebus (>=0.3.3, <=0.6.6) +43 more potentially affected by unknown CVE via h3 (2.0.0-rc.1)

h3 NPM version 2.0.0-rc.1 is affected by a known vulnerability. The following packages have a transitive dependency on h3 and may be impacted: - @brendonovich/solidjsstart =0.0.0, =0.3.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.24...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +220 more potentially affected by CVE-2026-86251 via h3 (>=1.0.1, <=1.15.6)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: CVE-2026-86251 Source advisory: OSV:GHSA-72GR-QFP7-VWHW...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +220 more potentially affected by unknown CVE via h3 (>=1.0.1, <=1.15.6)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-H3-15745711...

@abiswas97/postgres-mcp (2.0.0), @ampt/sql (1.0.1) +748 more potentially affected by CVE-2026-33468 via kysely (>=0.3.9, <=0.28.13)

kysely NPM version =0.3.9, =1.0.25-beta.0, =0.0.19, =1.2.6-beta.2, =0.0.1, =0.0.0, =0.1.0, =0.0.2, =0.0.1, =2.7.6, =0.2.0, =11.3.0 and more Source cves: CVE-2026-33468 Source advisory: OSV:GHSA-8CPQ-38P9-67GX...

@abiswas97/postgres-mcp (2.0.0), @ampt/sql (1.0.1) +748 more potentially affected by CVE-2026-33468 via kysely (>=0.3.9, <=0.28.13)

kysely NPM version =0.3.9, =1.0.25-beta.0, =0.0.19, =1.2.6-beta.2, =0.0.1, =0.0.0, =0.1.0, =0.0.2, =0.0.1, =2.7.6, =0.2.0, =11.3.0 and more Source cves: CVE-2026-33468 Source advisory: SNYK:JS-KYSELY-15763566...

@mikro-orm/entity-generator (>=7.0.2-dev.17, <=7.0.5-dev.1), @mikro-orm/libsql (>=7.0.2-dev.17, <=7.0.5-dev.1) +11 more potentially affected by CVE-2026-33442 via kysely (>=0.28.12, <=0.28.13)

kysely NPM version =0.28.12, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.5-dev.1 - @omnitron-dev/omnitron 0.1.3 - @omnitron-dev/testing 0.1.3 - @omnitron-dev/titan-database 0.1.3 Source...

@mikro-orm/entity-generator (>=7.0.2-dev.17, <=7.0.5-dev.1), @mikro-orm/libsql (>=7.0.2-dev.17, <=7.0.5-dev.1) +11 more potentially affected by CVE-2026-33442 via kysely (>=0.28.12, <=0.28.13)

kysely NPM version =0.28.12, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.5-dev.1 - @omnitron-dev/omnitron 0.1.3 - @omnitron-dev/testing 0.1.3 - @omnitron-dev/titan-database 0.1.3 Source...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by CVE-2026-82866 via @pdfme/common (5.5.8)

@pdfme/common NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/common and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: CVE-2026-82866 Source advisory: OSV:GHSA-PGX6-7JCQ-2QFF...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by unknown CVE via @pdfme/common (5.5.8)

@pdfme/common NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/common and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: unknown CVE Source advisory: SNYK:JS-PDFMECOMMON-15746945...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by CVE-2026-82865 via @pdfme/schemas (5.5.8)

@pdfme/schemas NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: CVE-2026-82865 Source advisory: OSV:GHSA-XGX4-2WGV-4JHM...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by unknown CVE via @pdfme/schemas (5.5.8)

@pdfme/schemas NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: unknown CVE Source advisory: SNYK:JS-PDFMESCHEMAS-15746947...

dicebear (>=9.0.0, <=9.4.1) potentially affected by CVE-2026-33418 via @dicebear/converter (>=9.0.0, <=9.4.1)

@dicebear/converter NPM version =9.0.0, =9.0.0, =9.4.1 Source cves: CVE-2026-33418 Source advisory: SNYK:JS-DICEBEARCONVERTER-15746952...

dicebear (>=9.0.0, <=9.4.1) potentially affected by CVE-2026-33418 via @dicebear/converter (>=9.0.0, <=9.4.1)

@dicebear/converter NPM version =9.0.0, =9.0.0, =9.4.1 Source cves: CVE-2026-33418 Source advisory: OSV:GHSA-7J2X-32W6-P43P...

jwts (>=0.5.0, <=0.5.1), rustls-webpki (>=0.102.6, <=0.102.8) potentially affected by CVE-2026-4428 via aws-lc-sys (0.21.0)

aws-lc-sys CARGO version 0.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on aws-lc-sys and may be impacted: - jwts =0.5.0, =0.102.6, =0.102.8 Source cves: CVE-2026-4428 Source advisory: OSV:GHSA-9F94-5G5W-GF6R...

@2digits/tlo-mcp (>=0.1.0, <=0.1.10), @6qat/tcp-connection (>=0.2.6, <=0.2.9) +731 more potentially affected by CVE-2026-32887 via effect (>=3.0.0, <=3.19.19)

effect NPM version =3.0.0, =0.1.0, =0.2.6, =1.0.0, =0.1.0-alpha.1, =0.0.1, =0.1.0-alpha.1, =0.1.1, =0.0.1, =0.0.5, =0.0.1, =0.2.1, =0.4.2 - @arvkonstantin/framework-provider-local-pg 3.4.3 and more Source cves: CVE-2026-32887 Source advisory: SNYK:JS-EFFECT-15746380...

@2digits/tlo-mcp (>=0.1.0, <=0.1.10), @6qat/tcp-connection (>=0.2.6, <=0.2.9) +731 more potentially affected by CVE-2026-32887 via effect (>=3.0.0, <=3.19.19)

effect NPM version =3.0.0, =0.1.0, =0.2.6, =1.0.0, =0.1.0-alpha.1, =0.0.1, =0.1.0-alpha.1, =0.1.1, =0.0.1, =0.0.5, =0.0.1, =0.2.1, =0.4.2 - @arvkonstantin/framework-provider-local-pg 3.4.3 and more Source cves: CVE-2026-32887 Source advisory: OSV:GHSA-38F7-945M-QR2G...

@amqp-contract/asyncapi (>=0.2.0, <=0.20.0), @c15t/backend (>=1.1.0-canary.0, <=1.8.5) +13 more potentially affected by CVE-2026-33331 via @orpc/openapi (>=1.0.0-beta.1, <=1.13.8)

@orpc/openapi NPM version =1.0.0-beta.1, =0.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.0, =0.4.2, =1.0.0-beta.2, =0.0.0, =0.0.0, =1.0.0-beta.2, =1.0.0-beta.1, =1.2.0-canary.0, =1.8.5 Source cves: CVE-2026-33331 Sour...

aati (>=0.10.2, <=0.11.3), ablavema (0.4.2) +1697 more potentially affected by CVE-2026-33056 via tar (>=0.2.14, <=0.4.40)

tar CARGO version =0.2.14, =0.10.2, =0.1.0, =0.1.2, =0.23.0, =0.23.0, =0.9.0, =0.2.5-rc.5, =1.2.0, =0.5.4-rc.1, =0.5.4-rc.1, =0.6.0, =0.4.0, =0.4.2 and more Source cves: CVE-2026-33056 Source advisory: OSV:GHSA-J4XF-2G29-59PH...

aati (>=0.10.2, <=0.11.3), ablavema (0.4.2) +1697 more potentially affected by CVE-2026-33055 via tar (>=0.2.14, <=0.4.40)

tar CARGO version =0.2.14, =0.10.2, =0.1.0, =0.1.2, =0.23.0, =0.23.0, =0.9.0, =0.2.5-rc.5, =1.2.0, =0.5.4-rc.1, =0.5.4-rc.1, =0.6.0, =0.4.0, =0.4.2 and more Source cves: CVE-2026-33055 Source advisory: OSV:GHSA-GCHP-Q4R4-X4FF...

@react-portable/core (>=0.4.0, <=0.11.2), storybook-framework-qwik (>=0.3.0, <=0.4.0) potentially affected by CVE-2026-32701 via @builder.io/qwik-city (>=1.2.6, <=1.4.1)

@builder.io/qwik-city NPM version =1.2.6, =0.4.0, =0.3.0, =0.4.0 Source cves: CVE-2026-32701 Source advisory: SNYK:JS-BUILDERIOQWIKCITY-15747112...

@react-portable/core (>=0.4.0, <=0.11.2), storybook-framework-qwik (>=0.3.0, <=0.4.0) potentially affected by CVE-2026-32701 via @builder.io/qwik-city (>=1.2.6, <=1.4.1)

@builder.io/qwik-city NPM version =1.2.6, =0.4.0, =0.3.0, =0.4.0 Source cves: CVE-2026-32701 Source advisory: OSV:GHSA-WHHV-GG5V-864R...

a2 (>=0.2.0, <=0.5.0-alpha.7), abci (>=0.5.3, <=0.7.1) +2101 more potentially affected by unknown CVE via tokio-codec (>=0.1.2, <=0.2.0-alpha.6)

tokio-codec CARGO version =0.1.2, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.4.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0056...

a2 (>=0.2.0, <=0.5.0-alpha.7), abci (>=0.5.3, <=0.7.1) +3152 more potentially affected by unknown CVE via tokio-sync (>=0.1.8, <=0.2.0-alpha.6)

tokio-sync CARGO version =0.1.8, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.8.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0052...

a2 (>=0.2.0, <=0.5.0-alpha.7), abci (>=0.5.3, <=0.6.2) +1876 more potentially affected by unknown CVE via tokio-fs (>=0.1.7, <=0.2.0-alpha.6)

tokio-fs CARGO version =0.1.7, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.4.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.2.0 - actix-multipart-rfc7578 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0061...

a2 (>=0.2.0, <=0.5.0-alpha.7), abci (>=0.5.3, <=0.7.1) +3197 more potentially affected by unknown CVE via tokio-executor (>=0.1.10, <=0.2.0-alpha.6)

tokio-executor CARGO version =0.1.10, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.8.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0063...

a2 (>=0.2.0, <=0.4.1), abci (>=0.5.3, <=0.7.1) +2900 more potentially affected by unknown CVE via tokio-threadpool (>=0.1.14, <=0.2.0-alpha.1)

tokio-threadpool CARGO version =0.1.14, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0051...

a2 (>=0.2.0, <=0.4.1), abci (>=0.5.3, <=0.6.2) +1930 more potentially affected by unknown CVE via tokio-udp (>=0.1.0, <=0.2.0-alpha.1)

tokio-udp CARGO version =0.1.0, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.4.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0-alpha.1, =0.3.0, =0.4.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0064...

a2 (>=0.2.0, <=0.4.1), abci (>=0.5.3, <=0.6.2) +1843 more potentially affected by unknown CVE via tokio-uds (>=0.1.5, <=0.3.0-alpha.1)

tokio-uds CARGO version =0.1.5, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.4.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.2.0 - actix-multipart-rfc7578 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0050...

a2 (>=0.2.0, <=0.5.0-alpha.7), abci (>=0.5.3, <=0.7.1) +3108 more potentially affected by unknown CVE via tokio-timer (>=0.1.2, <=0.3.0-alpha.6)

tokio-timer CARGO version =0.1.2, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.8.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0060...

a2 (>=0.2.0, <=0.4.1), abci (>=0.5.3, <=0.7.1) +3050 more potentially affected by unknown CVE via tokio-tcp (>=0.1.4, <=0.2.0-alpha.1)

tokio-tcp CARGO version =0.1.4, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0059...

abci-rs (0.10.0), abuseipdb (>=0.1.0, <=0.2.1) +1841 more potentially affected by unknown CVE via tokio-tls (>=0.2.1, <=0.3.1)

tokio-tls CARGO version =0.2.1, =0.1.0, =0.1.0, =0.7.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.4.0, =1.0.0-alpha.3, =0.7.4, =0.7.19 - actori-tls 1.0.0 - actyxosdataflow 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0053...

a2 (>=0.2.0, <=0.5.0-alpha.7), abci (>=0.5.3, <=0.7.1) +3338 more potentially affected by unknown CVE via tokio-io (>=0.1.5, <=0.2.0-alpha.6)

tokio-io CARGO version =0.1.5, =0.2.0, =0.5.3, =0.2.1, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0058...

graph-generator-lib (>=0.1.0, <=0.1.10), libunftp (>=0.6.0, <=0.6.1) +7 more potentially affected by unknown CVE via tokio-compat (0.1.6)

tokio-compat CARGO version 0.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on tokio-compat and may be impacted: - graph-generator-lib =0.1.0, =0.6.0, =0.1.0, =0.1.3 - parity-runtime 0.1.2 - price-info 1.12.0 - rudolfs 0.2.11 - sccache 0.2.15 -...

a2 (>=0.2.0, <=0.4.1), abci (>=0.5.3, <=0.7.1) +3083 more potentially affected by unknown CVE via tokio-reactor (>=0.1.3, <=0.2.0-alpha.1)

tokio-reactor CARGO version =0.1.3, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0057...

webpki-roots (>=0.26.0-alpha.0, <=0.26.0-alpha.1) potentially affected by unknown CVE via rustls-webpki (0.102.8)

rustls-webpki CARGO version 0.102.8 is affected by a known vulnerability. The following packages have a transitive dependency on rustls-webpki and may be impacted: - webpki-roots =0.26.0-alpha.0, =0.26.0-alpha.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0049...

actix (>=0.1.0, <=0.7.10), actix-async-await (>=0.1.0, <=0.3.0) +485 more potentially affected by unknown CVE via tokio-signal (>=0.1.5, <=0.3.0-alpha.1)

tokio-signal CARGO version =0.1.5, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0-alpha.1, =0.3.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.7.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0065...

a2 (>=0.2.0, <=0.4.1), abci (>=0.5.3, <=0.7.1) +3003 more potentially affected by unknown CVE via tokio-current-thread (>=0.1.7, <=0.2.0-alpha.1)

tokio-current-thread CARGO version =0.1.7, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0054...

adventure-rusoto-ecs (0.4.0), adventure-rusoto-sns (0.4.0) +240 more potentially affected by unknown CVE via tokio-process (>=0.1.6, <=0.3.0-alpha.2)

tokio-process CARGO version =0.1.6, =0.0.2, =0.0.1, =0.1.5, =0.1.0, =0.2.1, =0.3.0, =0.1.0, =0.21.0, =0.2.0, =0.6.0, =0.6.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0055...

acegisecurity:acegi-security (0.7.0), acegisecurity:acegi-security-cas (0.7.0) +4 more potentially affected by CVE-2026-22737 via springframework:spring-webmvc (>=1.1.3, <=1.2.1)

springframework:spring-webmvc MAVEN version =1.1.3, =1.0-rc2, =1.0-rc3 Source cves: CVE-2026-22737 Source advisory: SNYK:JAVA-SPRINGFRAMEWORK-15701846...

@abiswas97/postgres-mcp (2.0.0), @ampt/sql (1.0.1) +631 more potentially affected by CVE-2026-32763 via kysely (>=0.26.3, <=0.28.11)

kysely NPM version =0.26.3, =1.0.25-beta.0, =0.0.19, =1.2.6-beta.2, =2.7.6, =0.2.0, =0.0.1, =0.0.17, =0.0.2, =0.0.65, =1.0.24, =1.2.23, =1.2.27 and more Source cves: CVE-2026-32763 Source advisory: SNYK:JS-KYSELY-15763565...

@hmcts/media-viewer (>=4.2.16-exui-4425, <=4.2.16-exui-4425-rel1) potentially affected by CVE-2026-27738 +1 more via @angular/ssr (20.3.18)

@angular/ssr NPM version 20.3.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/ssr and may be impacted: - @hmcts/media-viewer =4.2.16-exui-4425, =4.2.16-exui-4425-rel1 Source cves: CVE-2026-27738, CVE-2026-33397 Source advisory:...

create-momentum-app (>=0.1.2, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-33397 via @angular/ssr (>=21.1.2, <=21.2.0)

@angular/ssr NPM version =21.1.2, =0.1.2, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-33397 Source advisory: OSV:GHSA-VFX2-HV2G-XJ5F...

@hmcts/media-viewer (>=4.2.16-exui-4425, <=4.2.16-exui-4425-rel1) potentially affected by CVE-2026-33397 via @angular/ssr (20.3.18)

@angular/ssr NPM version 20.3.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/ssr and may be impacted: - @hmcts/media-viewer =4.2.16-exui-4425, =4.2.16-exui-4425-rel1 Source cves: CVE-2026-33397 Source advisory: OSV:GHSA-VFX2-HV2G-XJ5F...

create-momentum-app (>=0.1.2, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-27738 +1 more via @angular/ssr (>=21.1.2, <=21.2.0)

@angular/ssr NPM version =21.1.2, =0.1.2, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-27738, CVE-2026-33397 Source advisory: SNYK:JS-ANGULARSSR-15701178...

0xuath-sdk-react (>=0.0.2, <=0.0.23), 1-test-gulp-1 (>=0.0.1, <=0.0.4) +15483 more potentially affected by CVE-2026-33349 via fast-xml-parser (>=4.0.0, <=5.5.6)

fast-xml-parser NPM version =4.0.0, =0.0.2, =0.0.1, =0.0.1, =1.0.0, =3.1.4, =0.1.0, =3.1.6, =0.1.0, =0.0.2, =4.11.2, =4.11.46 - @0610studio/rn-layout 0.0.1 - @0xflick/jest-dynamodb 4.0.1-pre.2 and more Source cves: CVE-2026-33349 Source advisory: SNYK:JS-FASTXMLPARSER-15699647...