bws-web-server (>=0.1.0, <=0.1.1), pingora (>=0.1.0, <=0.6.0) +6 more potentially affected by CVE-2026-2835 via pingora-core (>=0.1.1, <=0.6.0)

pingora-core CARGO version =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.7 - revoke-gateway 0.3.0 - static-files-module 0.1.0 Source cves: CVE-2026-2835 Source advisory: OSV:RUSTSEC-2026-0034...

libcrux-aead (>=0.0.4-pre.1, <=0.0.6) potentially affected by unknown CVE via libcrux-poly1305 (0.0.4)

libcrux-poly1305 CARGO version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-poly1305 and may be impacted: - libcrux-aead =0.0.4-pre.1, =0.0.6 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0073...

bws-web-server (>=0.1.0, <=0.1.1), pingora (>=0.1.0, <=0.6.0) +3 more potentially affected by CVE-2026-2836 via pingora-cache (>=0.1.1, <=0.6.0)

pingora-cache CARGO version =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.6.0 - revoke-gateway 0.3.0 - static-files-module 0.1.0 Source cves: CVE-2026-2836 Source advisory: OSV:RUSTSEC-2026-0035...

@3t-transform/threeteeui (>=1.5.1, <=1.11.0), @8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4) +1258 more potentially affected by CVE-2025-15599 via dompurify (>=3.0.0, <=3.2.6)

dompurify NPM version =3.0.0, =1.5.1, =0.18.0-beta.0, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =1.2.0, =1.0.0, =4.4.0-rc1, =6.4.10, =5.1.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.2, =1.0.9 and more Source cves: CVE-2025-15599 Source advisory: SNYK:JS-DOMPURIFY-15371386...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2059 more potentially affected by CVE-2026-0540 via dompurify (>=3.0.0, <=3.3.1)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =0.2.10 and more Source cves: CVE-2026-0540 Source advisory: SNYK:JS-DOMPURIFY-15371376...

@0xgg/echomd (>=1.0.0, <=1.0.4), @7nohe/vite-plugin-vue-marked (0.2.1) +1085 more potentially affected by CVE-2026-0540 via dompurify (>=2.0.0, <=2.5.8)

dompurify NPM version =2.0.0, =1.0.0, =0.2.0-beta.9, =0.2.0-beta.13, =6.2.3, =6.4.3, =0.0.2-next.4, =0.3.0, =0.1.0, =0.1.0-a0, =1.0.0, =0.4.0, =0.0.18, =0.0.32 and more Source cves: CVE-2026-0540 Source advisory: SNYK:JS-DOMPURIFY-15371376...

jsonwebtoken-aws-lc (9.3.0), jwts (>=0.5.0, <=0.5.1) +1 more potentially affected by CVE-2026-3337 via aws-lc-sys (>=0.14.1, <=0.21.0)

aws-lc-sys CARGO version =0.14.1, =0.5.0, =0.102.2, =0.102.8 Source cves: CVE-2026-3337 Source advisory: OSV:GHSA-65P9-R9H6-22VJ...

ghost-blade (0.1.0), ohm (>=0.1.7, <=0.1.10) +1 more potentially affected by CVE-2026-29053 via ghost (>=0.11.14, <=1.26.2)

ghost NPM version =0.11.14, =0.1.7, =0.1.10 - sign-alex 1.0.1 Source cves: CVE-2026-29053 Source advisory: OSV:GHSA-CGC2-RCRH-QR5X...

@8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4), @accelbyte/sdk-legal (>=0.0.0-dev-20241106153220, <=6.3.2) +1044 more potentially affected by CVE-2025-15599 via dompurify (>=3.1.3, <=3.2.6)

dompurify NPM version =3.1.3, =0.18.0-beta.0, =0.0.0-dev-20241106153220, =1.0.0, =4.4.0-rc1, =6.4.23, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.2, =1.0.0, =0.1.1, =0.1.5-alpha.2, =0.1.1, =0.1.6 and more Source cves: CVE-2025-15599 Source advisory: OSV:GHSA-V8JM-5VWX-CFXM...

@atlassian/aui (>=9.3.22, <=10.0.0-M02), @charcoal-ui/icons (>=3.16.0, <=3.21.0) +116 more potentially affected by CVE-2026-0540 via dompurify (>=2.5.4, <=2.5.8)

dompurify NPM version =2.5.4, =9.3.22, =3.16.0, =3.0.0-beta.0, =3.0.0-beta.0, =0.0.0-canary-20240806060533, =0.0.0-canary-20240806060533, =0.0.0-canary-20240806060533, =0.0.0-canary-20240806060533, =0.0.0-canary-20240719153432, =0.0.0-fec-156-react19-20250116105607,...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +1853 more potentially affected by CVE-2026-0540 via dompurify (>=3.1.3, <=3.3.1)

dompurify NPM version =3.1.3, =0.3.96, =0.5.12, =0.3.33, =0.5.0, =0.4.71, =1.0.0, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20241106153220, =1.0.0, =1.0.35 and more Source cves: CVE-2026-0540 Source advisory: OSV:GHSA-V2WJ-7WPQ-C8VV...

@atlassian/aui (>=9.3.22, <=10.0.0-M02), @charcoal-ui/icons (>=3.16.0, <=3.21.0) +116 more potentially affected by CVE-2025-15599 via dompurify (>=2.5.4, <=2.5.8)

dompurify NPM version =2.5.4, =9.3.22, =3.16.0, =3.0.0-beta.0, =3.0.0-beta.0, =0.0.0-canary-20240806060533, =0.0.0-canary-20240806060533, =0.0.0-canary-20240806060533, =0.0.0-canary-20240806060533, =0.0.0-canary-20240719153432, =0.0.0-fec-156-react19-20250116105607,...

ai-dynamo (>=0.1.0, <=0.3.0), bento-sgl-router (>=0.0.1, <=0.0.6) +31 more potentially affected by CVE-2026-27905 via bentoml (>=0.9.2, <=1.4.39)

bentoml PYPI version =0.9.2, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.2.3, =0.0.1, =0.0.10, =0.1.0, =0.2.0, =0.0.1, =0.3.12.dev20240709150559, =0.3.52 and more Source cves: CVE-2026-27905 Source advisory: SNYK:PYTHON-BENTOML-15372202...

-react-file-list-components (1.1.1), 01basicreact (>=0.1.0, <=0.1.9) +59225 more potentially affected by CVE-2026-27601 via underscore (>=1.0.3, <=1.13.7)

underscore NPM version =1.0.3, =0.1.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 - 0scarclassi 1.0.1 - 0scarclassj 1.0.1 and more Source cves:...

-react-file-list-components (1.1.1), 01basicreact (>=0.1.0, <=0.1.9) +59225 more potentially affected by CVE-2026-27601 via underscore (>=1.0.3, <=1.13.7)

underscore NPM version =1.0.3, =0.1.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 - 0scarclassi 1.0.1 - 0scarclassj 1.0.1 and more Source cves:...

org.glassfish.mq:mq-client (>=6.4.0, <=6.9.0), org.glassfish.mq:mq-cluster (>=6.4.0, <=6.9.0) +12 more potentially affected by CVE-2026-22886 via org.glassfish.mq:mqbroker-core (>=6.4.0, <=6.9.0)

org.glassfish.mq:mqbroker-core MAVEN version =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.9.0 Source cves: CVE-2026-22886 Source advisory: SNYK:JAVA-ORGGLASSFISHMQ-15444256...

@activepieces/piece-snowflake (>=0.2.1, <=0.3.0), @bhanu17/nextjs-starter (>=1.2.0, <=2.2.14) +100 more potentially affected by CVE-2026-3449 via @tootallnate/once (2.0.0)

@tootallnate/once NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @tootallnate/once and may be impacted: - @activepieces/piece-snowflake =0.2.1, =1.2.0, =0.0.18, =0.2.0, =0.0.6, =0.0.1, =50.32.5-depup.0, =0.6.0, =0.4.2, =0.1.10,...

@activeboxes/piece-gmail (0.8.1), @activeboxes/piece-imap (0.2.10) +77 more potentially affected by CVE-2026-3455 via mailparser (>=3.0.0, <=3.9.1)

mailparser NPM version =3.0.0, =0.6.0, =0.0.1, =0.0.1, =1.0.0, =0.5.0, =1.0.64-alpha, =1.0.21-alpha, =4.0.1-alpha, =6.1.180-alpha and more Source cves: CVE-2026-3455 Source advisory: OSV:GHSA-7GMJ-H9XC-MCXC...

@amqp-contract/asyncapi (>=0.2.0, <=0.20.0), @bgd-labs/indexer-client (>=1.23.1, <=1.42.1) +49 more potentially affected by CVE-2026-28794 via @orpc/client (>=1.0.0-beta.1, <=1.13.5)

@orpc/client NPM version =1.0.0-beta.1, =0.2.0, =1.23.1, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.0-beta.20, =0.1.21, =0.1.0, =0.1.9, =0.4.2, =0.0.0, =1.13.5 and more Source cves: CVE-2026-28794 Source advisory:...

@amqp-contract/asyncapi (>=0.2.0, <=0.20.0), @bgd-labs/indexer-client (>=1.23.1, <=1.42.1) +49 more potentially affected by CVE-2026-28794 via @orpc/client (>=1.0.0-beta.1, <=1.13.5)

@orpc/client NPM version =1.0.0-beta.1, =0.2.0, =1.23.1, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.0-beta.20, =0.1.21, =0.1.0, =0.1.9, =0.4.2, =0.0.0, =1.13.5 and more Source cves: CVE-2026-28794 Source advisory:...

@qwikui-org/ui (>=0.2.2, <=0.2.3), @react-portable/core (>=0.4.0, <=0.11.2) +1 more potentially affected by CVE-2026-27971 via @builder.io/qwik (>=1.2.6, <=1.4.5)

@builder.io/qwik NPM version =1.2.6, =0.2.2, =0.4.0, =0.11.2 - not-qwik-library-test1 0.0.3 Source cves: CVE-2026-27971 Source advisory: OSV:GHSA-P9X5-JP3H-96MM...

@qwikui-org/ui (>=0.2.2, <=0.2.3), @react-portable/core (>=0.4.0, <=0.11.2) +1 more potentially affected by CVE-2026-27971 via @builder.io/qwik (>=1.2.6, <=1.4.5)

@builder.io/qwik NPM version =1.2.6, =0.2.2, =0.4.0, =0.11.2 - not-qwik-library-test1 0.0.3 Source cves: CVE-2026-27971 Source advisory: SNYK:JS-BUILDERIOQWIK-15369137...

@oneuptime/cli (>=10.0.5, <=10.0.11) potentially affected by CVE-2026-28787 via @oneuptime/common (>=10.0.5, <=10.0.11)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.11 Source cves: CVE-2026-28787 Source advisory: OSV:GHSA-GJJC-PCWP-C74M...

@oneuptime/cli (>=10.0.5, <=10.0.14) potentially affected by CVE-2026-28787 via @oneuptime/common (>=10.0.5, <=10.0.14)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.14 Source cves: CVE-2026-28787 Source advisory: SNYK:JS-ONEUPTIMECOMMON-15369565...

@dyyxyzz/baileys-mod (>=6.0.32, <=6.0.54) potentially affected by unknown CVE via @daffadeveloper/libsignal-node (0.0.1-security)

@daffadeveloper/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @daffadeveloper/libsignal-node and may be impacted: - @dyyxyzz/baileys-mod =6.0.32, =6.0.54 Source cves: unknown CVE Source advisory:...

@dyyxyzz/baileys-mod (>=6.0.32, <=6.0.54) potentially affected by unknown CVE via @daffadeveloper/libsignal-node (0.0.1-security)

@daffadeveloper/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @daffadeveloper/libsignal-node and may be impacted: - @dyyxyzz/baileys-mod =6.0.32, =6.0.54 Source cves: unknown CVE Source advisory:...

@goldenqueen/bai (>=1.0.0, <=1.0.3), @khineeyouu/baileys (>=0.2.1, <=0.2.24) +10 more potentially affected by unknown CVE via @yaoii-bails/libsignall-node (0.0.1-security)

@yaoii-bails/libsignall-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @yaoii-bails/libsignall-node and may be impacted: - @goldenqueen/bai =1.0.0, =0.2.1, =2.0.16, =17.1.12, =1.0.13, =1.0.23, =1.0.24 - nopedorex 1.0.0 ...

@goldenqueen/bai (>=1.0.0, <=1.0.3), @khineeyouu/baileys (>=0.2.1, <=0.2.24) +10 more potentially affected by unknown CVE via @yaoii-bails/libsignall-node (0.0.1-security)

@yaoii-bails/libsignall-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @yaoii-bails/libsignall-node and may be impacted: - @goldenqueen/bai =1.0.0, =0.2.1, =2.0.16, =17.1.12, =1.0.13, =1.0.23, =1.0.24 - nopedorex 1.0.0 ...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @dismissible/nestjs-api (>=1.0.3-alpha.0b30e6d.0, <=2.0.2-canary.2913ba8.0) +6 more potentially affected by CVE-2026-2293 via @nestjs/platform-fastify (>=11.0.1, <=11.1.13)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.63 Source cves: CVE-2026-2293 Source advisory: OSV:GHSA-R4WM-X892-VJMX...

jsonwebtoken-aws-lc (9.3.0), jwts (>=0.5.0, <=0.5.1) +1 more potentially affected by CVE-2026-3337 via aws-lc-sys (>=0.14.1, <=0.21.0)

aws-lc-sys CARGO version =0.14.1, =0.5.0, =0.102.2, =0.102.8 Source cves: CVE-2026-3337 Source advisory: OSV:RUSTSEC-2026-0045...

dbgpt-app (0.8.0rc1), dbgpt-client (>=0.7.0rc0, <=0.8.2) +2 more potentially affected by CVE-2026-3409 via dbgpt (0.8.2)

dbgpt PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on dbgpt and may be impacted: - dbgpt-app 0.8.0rc1 - dbgpt-client =0.7.0rc0, =0.7.0rc0, =0.8.0rc1, =0.8.2 Source cves: CVE-2026-3409 Source advisory: SNYK:PYTHON-DBGPT-15426547...

4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1510 more potentially affected by CVE-2026-3304 via multer (>=2.0.0, <=2.0.2)

multer NPM version =2.0.0, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =0.6.2 and more Source cves: CVE-2026-3304 Source advisory: OSV:GHSA-XF7R-HGR6-V32P...

org.webjars.npm:nestjs__platform-express (>=8.4.7, <=9.0.0-next.2) potentially affected by CVE-2026-2359 via org.webjars.npm:multer (1.4.4-lts.1)

org.webjars.npm:multer MAVEN version 1.4.4-lts.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:multer and may be impacted: - org.webjars.npm:nestjsplatform-express =8.4.7, =9.0.0-next.2 Source cves: CVE-2026-2359 Source advisory:...

4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1510 more potentially affected by CVE-2026-2359 via multer (>=2.0.0, <=2.0.2)

multer NPM version =2.0.0, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =0.6.2 and more Source cves: CVE-2026-2359 Source advisory: OSV:GHSA-V52C-386H-88MC...

4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1510 more potentially affected by CVE-2026-2359 via multer (>=2.0.0, <=2.0.2)

multer NPM version =2.0.0, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =0.6.2 and more Source cves: CVE-2026-2359 Source advisory: SNYK:JS-MULTER-15365916...

@internxt/cli (>=1.0.5, <=1.2.2), @latitude-data/cli (>=0.0.29, <=1.11.0-canary.8) +10 more potentially affected by unknown CVE via serialize-javascript (>=7.0.0, <=7.0.2)

serialize-javascript NPM version =7.0.0, =1.0.5, =0.0.29, =0.7.5, =1.3.0, =0.1.0, =1.0.7, =0.2.0, =0.7.0-alpha.6 Source cves: unknown CVE Source advisory: OSV:GHSA-5C6J-R48X-RMVQ...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.7.1) +11 more potentially affected by CVE-2026-2880 via @fastify/middie (>=9.0.2, <=9.1.0)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.63 Source cves: CVE-2026-2880 Source advisory: OSV:GHSA-8P85-9QPW-FWGW...

@darka-software/text-design-qwik (>=0.0.137, <=0.0.139), @turnipxenon/pineapple (>=5.0.0-alpha.1, <=5.0.0-alpha.5) +1 more potentially affected by unknown CVE via @sveltejs/kit (>=2.49.0, <=2.49.5)

@sveltejs/kit NPM version =2.49.0, =0.0.137, =5.0.0-alpha.1, =1.12.2, =1.12.3 Source cves: unknown CVE Source advisory: SNYK:JS-SVELTEJSKIT-15366380...

@darka-software/text-design-qwik (>=0.0.137, <=0.0.139), @turnipxenon/pineapple (>=5.0.0-alpha.1, <=5.0.0-alpha.5) +1 more potentially affected by CVE-2026-82259 via @sveltejs/kit (>=2.49.0, <=2.49.5)

@sveltejs/kit NPM version =2.49.0, =0.0.137, =5.0.0-alpha.1, =1.12.2, =1.12.3 Source cves: CVE-2026-82259 Source advisory: OSV:GHSA-FPG4-JHQR-589C...

@activeboxes/piece-sftp (0.2.6), @activepieces/piece-apify (0.2.1) +24 more potentially affected by CVE-2026-27699 via basic-ftp (>=5.0.2, <=5.1.0)

basic-ftp NPM version =5.0.2, =0.2.6, =1.0.0, =1.0.0, =2.0.18, =1.9.2, =1.2.0, =4.6.0-blowfish, =1.0.3, =1.0.4, =0.1.1, =0.2.0 and more Source cves: CVE-2026-27699 Source advisory: SNYK:JS-BASICFTP-15366428...

leanplum-sdk (1.13.0) potentially affected by CVE-2026-26861 via clevertap-web-sdk (1.9.2)

clevertap-web-sdk NPM version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on clevertap-web-sdk and may be impacted: - leanplum-sdk 1.13.0 Source cves: CVE-2026-26861 Source advisory: SNYK:JS-CLEVERTAPWEBSDK-15366963...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.7.1) +11 more potentially affected by CVE-2026-2880 via @fastify/middie (>=9.0.2, <=9.1.0)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.63 Source cves: CVE-2026-2880 Source advisory: SNYK:JS-FASTIFYMIDDIE-15366397...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +40 more potentially affected by CVE-2026-27970 via @angular/core (>=19.0.0, <=19.2.18)

@angular/core NPM version =19.0.0, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 and more Source cves: CVE-2026-27970 Source advisory:...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +37 more potentially affected by CVE-2026-27970 via @angular/core (>=20.0.0, <=20.3.16)

@angular/core NPM version =20.0.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =9.0.0 and more Source cves: CVE-2026-27970 Source advisory: OSV:GHSA-PRJF-86W9-MFQV...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.192-alpha) +39 more potentially affected by CVE-2026-27970 via @angular/core (>=21.0.0, <=21.1.5)

@angular/core NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =4.0.0, =5.38.0, =4.0.0, =5.15.0, =4.0.0, =6.1.0-edge.4 and more Source cves: CVE-2026-27970 Source advisory: OSV:GHSA-PRJF-86W9-MFQV...

@agdo/object-model (>=1.0.1, <=1.2.34), @agilie/widget-template (>=1.0.2, <=1.1.6) +415 more potentially affected by CVE-2026-27970 via @angular/core (>=18.0.0, <=18.2.14)

@angular/core NPM version =18.0.0, =1.0.1, =1.0.2, =0.0.0, =1.0.0, =0.0.55, =1.0.0, =18.2.0, =7.0.0, =7.0.3 - @auscope/angular2parse 18.0.0 and more Source cves: CVE-2026-27970 Source advisory: OSV:GHSA-PRJF-86W9-MFQV...

leanplum-sdk (1.13.0) potentially affected by CVE-2026-26862 via clevertap-web-sdk (1.9.2)

clevertap-web-sdk NPM version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on clevertap-web-sdk and may be impacted: - leanplum-sdk 1.13.0 Source cves: CVE-2026-26862 Source advisory: OSV:GHSA-JFRQ-HJ9F-C8QX...

leanplum-sdk (1.13.0) potentially affected by CVE-2026-26861 via clevertap-web-sdk (1.9.2)

clevertap-web-sdk NPM version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on clevertap-web-sdk and may be impacted: - leanplum-sdk 1.13.0 Source cves: CVE-2026-26861 Source advisory: OSV:GHSA-J5MF-6RH3-RHGG...

org.webjars.npm:nestjs__platform-express (>=8.4.7, <=9.0.0-next.2) potentially affected by CVE-2026-3304 via org.webjars.npm:multer (1.4.4-lts.1)

org.webjars.npm:multer MAVEN version 1.4.4-lts.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:multer and may be impacted: - org.webjars.npm:nestjsplatform-express =8.4.7, =9.0.0-next.2 Source cves: CVE-2026-3304 Source advisory:...

4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1510 more potentially affected by CVE-2026-3304 via multer (>=2.0.0, <=2.0.2)

multer NPM version =2.0.0, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =0.6.2 and more Source cves: CVE-2026-3304 Source advisory: SNYK:JS-MULTER-15365918...