abacuz (>=0.1.0, <=0.1.1), acceptxmr (>=0.1.0, <=0.13.0) +167 more potentially affected by CVE-2026-72813 via actix-files (>=0.1.0-alpha.6, <=0.6.6)

actix-files CARGO version =0.1.0-alpha.6, =0.1.0, =0.1.0, =1.0.0-alpha.6, =0.3.0, =0.9.0, =0.1.0, =0.1.0, =3.6.0, =0.6.0, =0.34.0 - bassment 0.1.0 - boltserver 0.11.11 and more Source cves: CVE-2026-72813 Source advisory: OSV:GHSA-GCQF-3G44-VC9P...

abacuz (>=0.1.0, <=0.1.1), acceptxmr (>=0.1.0, <=0.13.0) +167 more potentially affected by CVE-2026-72814 via actix-files (>=0.1.0-alpha.6, <=0.6.6)

actix-files CARGO version =0.1.0-alpha.6, =0.1.0, =0.1.0, =1.0.0-alpha.6, =0.3.0, =0.9.0, =0.1.0, =0.1.0, =3.6.0, =0.6.0, =0.34.0 - bassment 0.1.0 - boltserver 0.11.11 and more Source cves: CVE-2026-72814 Source advisory: OSV:GHSA-8V2V-WJWG-VX6R...

@nelluriramu/oegesbot (1.0.0) potentially affected by CVE-2026-25651 via client-certificate-auth (0.3.0)

client-certificate-auth NPM version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on client-certificate-auth and may be impacted: - @nelluriramu/oegesbot 1.0.0 Source cves: CVE-2026-25651 Source advisory: SNYK:JS-CLIENTCERTIFICATEAUTH-15248346...

@nelluriramu/oegesbot (1.0.0) potentially affected by CVE-2026-25651 via client-certificate-auth (0.3.0)

client-certificate-auth NPM version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on client-certificate-auth and may be impacted: - @nelluriramu/oegesbot 1.0.0 Source cves: CVE-2026-25651 Source advisory: OSV:GHSA-M4W9-GCH5-C2G4...

@es-joy/jsoe (>=0.0.1, <=0.16.0) potentially affected by CVE-2026-25581 via sceditor (3.2.0)

sceditor NPM version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on sceditor and may be impacted: - @es-joy/jsoe =0.0.1, =0.16.0 Source cves: CVE-2026-25581 Source advisory: OSV:GHSA-25FQ-6QGG-QPJ8...

@es-joy/jsoe (>=0.0.1, <=0.16.0) potentially affected by CVE-2026-25581 via sceditor (3.2.0)

sceditor NPM version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on sceditor and may be impacted: - @es-joy/jsoe =0.0.1, =0.16.0 Source cves: CVE-2026-25581 Source advisory: SNYK:JS-SCEDITOR-15248349...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @mieweb/wikigdrive (>=2.15.0, <=2.17.1) +3 more potentially affected by CVE-2026-25641 via @nyariv/sandboxjs (>=0.5.3, <=0.8.25)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =2.15.0, =0.2.0, =11.0.0, =12.0.1 Source cves: CVE-2026-25641 Source advisory: SNYK:JS-NYARIVSANDBOXJS-15248293...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @mieweb/wikigdrive (>=2.15.0, <=2.17.1) +3 more potentially affected by CVE-2026-25641 via @nyariv/sandboxjs (>=0.5.3, <=0.8.25)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =2.15.0, =0.2.0, =11.0.0, =12.0.1 Source cves: CVE-2026-25641 Source advisory: OSV:GHSA-7X3H-RM86-3342...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @mieweb/wikigdrive (>=2.15.0, <=2.17.1) +3 more potentially affected by CVE-2026-25587 via @nyariv/sandboxjs (>=0.5.3, <=0.8.25)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =2.15.0, =0.2.0, =11.0.0, =12.0.1 Source cves: CVE-2026-25587 Source advisory: OSV:GHSA-66H4-QJ4X-38XP...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @mieweb/wikigdrive (>=2.15.0, <=2.17.1) +3 more potentially affected by CVE-2026-25142 +1 more via @nyariv/sandboxjs (>=0.5.3, <=0.8.25)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =2.15.0, =0.2.0, =11.0.0, =12.0.1 Source cves: CVE-2026-25142, CVE-2026-25587 Source advisory: SNYK:JS-NYARIVSANDBOXJS-15248292...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @mieweb/wikigdrive (>=2.15.0, <=2.17.1) +3 more potentially affected by CVE-2026-25586 via @nyariv/sandboxjs (>=0.5.3, <=0.8.25)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =2.15.0, =0.2.0, =11.0.0, =12.0.1 Source cves: CVE-2026-25586 Source advisory: OSV:GHSA-JJPW-65FV-8G48...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @mieweb/wikigdrive (>=2.15.0, <=2.17.1) +3 more potentially affected by CVE-2026-25586 via @nyariv/sandboxjs (>=0.5.3, <=0.8.25)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =2.15.0, =0.2.0, =11.0.0, =12.0.1 Source cves: CVE-2026-25586 Source advisory: SNYK:JS-NYARIVSANDBOXJS-15248294...

@01.software/sdk (>=0.0.1-251008.90016, <=0.1.4), @adenta/cms (>=0.0.6, <=1.1.1-0) +28 more potentially affected by CVE-2026-25574 via payload (>=3.0.0-alpha.49, <=3.73.0-internal.783bc97)

payload NPM version =3.0.0-alpha.49, =0.0.1-251008.90016, =0.0.6, =0.0.3, =1.0.1-beta.0, =1.0.0, =0.1.0, =1.0.0, =3.1.0-types, =1.0.0, =3.64.0, =0.0.1-beta.0, =0.2.0, =0.2.14 - @remy90/payload-conditions-plugin 0.2.2 and more Source cves: CVE-2026-25574 Source advisory: OSV:GHSA-JQ29-R496-R955...

@01.software/sdk (>=0.0.1-251008.90016, <=0.1.4), @adenta/cms (>=0.0.6, <=1.1.1-0) +28 more potentially affected by CVE-2026-25574 via payload (>=3.0.0-alpha.49, <=3.73.0-internal.783bc97)

payload NPM version =3.0.0-alpha.49, =0.0.1-251008.90016, =0.0.6, =0.0.3, =1.0.1-beta.0, =1.0.0, =0.1.0, =1.0.0, =3.1.0-types, =1.0.0, =3.64.0, =0.0.1-beta.0, =0.2.0, =0.2.14 - @remy90/payload-conditions-plugin 0.2.2 and more Source cves: CVE-2026-25574 Source advisory: SNYK:JS-PAYLOAD-15239949...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.1.2) +23 more potentially affected by CVE-2026-25544 via @payloadcms/drizzle (>=3.0.0, <=3.72.0-internal.3e70d4c)

@payloadcms/drizzle NPM version =3.0.0, =0.0.6, =0.0.6, =3.22.1, =3.37.0, =1.0.0, =3.53.0, =3.61.1-2, =3.50.0-internal.ca62628, =3.0.0-beta.74, =3.0.0-beta.74, =3.0.0-beta.116, =1.0.1, =1.0.2 and more Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-15240185...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +16 more potentially affected by CVE-2026-25544 via @payloadcms/next (>=3.0.0-beta.48, <=3.72.0-internal.3e70d4c)

@payloadcms/next NPM version =3.0.0-beta.48, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.2.0, =0.2.0, =1.0.54, =0.1.0, =0.1.4, =1.0.0, =0.0.9-alpha.5, =3.0.0-beta.3, =1.53.40, =1.53.45 and more Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSNEXT-15240192...

@ainsleydev/payload-helper (>=0.0.6, <=0.1.2), @davincicoding/payload-plugin-kit (0.0.4) +9 more potentially affected by CVE-2026-25544 via @payloadcms/db-sqlite (>=3.0.0-beta.116, <=3.72.0)

@payloadcms/db-sqlite NPM version =3.0.0-beta.116, =0.0.6, =1.1.10, =1.2.0 - payload-smart-deletion 1.0.7 - simple-shop 1.0.0 Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDBSQLITE-15240188...

@adenta/cms (>=0.0.6, <=1.1.1-0), @lafllamme/personal-page-shared (>=1.0.0, <=1.2.0) +3 more potentially affected by CVE-2026-25544 via @payloadcms/db-postgres (>=3.0.0-beta.135, <=3.61.0)

@payloadcms/db-postgres NPM version =3.0.0-beta.135, =0.0.6, =1.0.0, =0.0.9-alpha.5, =0.0.9-alpha.58 - payload-auth-plugin 0.7.5 Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDBPOSTGRES-15240187...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.1.2) +23 more potentially affected by CVE-2026-25544 via @payloadcms/drizzle (>=3.0.0, <=3.72.0-internal.3e70d4c)

@payloadcms/drizzle NPM version =3.0.0, =0.0.6, =0.0.6, =3.22.1, =3.37.0, =1.0.0, =3.53.0, =3.61.1-2, =3.50.0-internal.ca62628, =3.0.0-beta.74, =3.0.0-beta.74, =3.0.0-beta.116, =1.0.1, =1.0.2 and more Source cves: CVE-2026-25544 Source advisory: OSV:GHSA-XX6W-JXG9-2WH8...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @mieweb/wikigdrive (>=2.15.0, <=2.17.1) +3 more potentially affected by CVE-2026-25520 via @nyariv/sandboxjs (>=0.5.3, <=0.8.25)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =2.15.0, =0.2.0, =11.0.0, =12.0.1 Source cves: CVE-2026-25520 Source advisory: OSV:GHSA-58JH-XV4V-PCX4...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @mieweb/wikigdrive (>=2.15.0, <=2.17.1) +3 more potentially affected by CVE-2026-25520 via @nyariv/sandboxjs (>=0.5.3, <=0.8.25)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =2.15.0, =0.2.0, =11.0.0, =12.0.1 Source cves: CVE-2026-25520 Source advisory: SNYK:JS-NYARIVSANDBOXJS-15248295...

@abdul-kissflow/form-field-scripts (0.0.7), @ableaura/ableui (0.1.0) +2558 more potentially affected by CVE-2025-68458 via webpack (>=5.49.0, <=5.104.0)

webpack NPM version =5.49.0, =0.0.1, =0.0.1, =0.0.1, =4.9.5, =0.0.1, =1.0.0, =1.0.0-rc2, =2.0.5-beta.11, =1.0.7-beta.4, =1.0.7-beta.4, =1.2.1-alpha.0 and more Source cves: CVE-2025-68458 Source advisory: SNYK:JS-WEBPACK-15235959...

@abdul-kissflow/form-field-scripts (0.0.7), @ableaura/ableui (0.1.0) +2558 more potentially affected by CVE-2025-68458 via webpack (>=5.49.0, <=5.104.0)

webpack NPM version =5.49.0, =0.0.1, =0.0.1, =0.0.1, =4.9.5, =0.0.1, =1.0.0, =1.0.0-rc2, =2.0.5-beta.11, =1.0.7-beta.4, =1.0.7-beta.4, =1.2.1-alpha.0 and more Source cves: CVE-2025-68458 Source advisory: OSV:GHSA-8FGC-7CC6-RX7X...

@abdul-kissflow/form-field-scripts (0.0.7), @ableaura/ableui (0.1.0) +2558 more potentially affected by CVE-2025-68157 via webpack (>=5.49.0, <=5.103.0)

webpack NPM version =5.49.0, =0.0.1, =0.0.1, =0.0.1, =4.9.5, =0.0.1, =1.0.0, =1.0.0-rc2, =2.0.5-beta.11, =1.0.7-beta.4, =1.0.7-beta.4, =1.2.1-alpha.0 and more Source cves: CVE-2025-68157 Source advisory: OSV:GHSA-38R7-794H-5758...

@abdul-kissflow/form-field-scripts (0.0.7), @ableaura/ableui (0.1.0) +2558 more potentially affected by CVE-2025-68157 via webpack (>=5.49.0, <=5.103.0)

webpack NPM version =5.49.0, =0.0.1, =0.0.1, =0.0.1, =4.9.5, =0.0.1, =1.0.0, =1.0.0-rc2, =2.0.5-beta.11, =1.0.7-beta.4, =1.0.7-beta.4, =1.2.1-alpha.0 and more Source cves: CVE-2025-68157 Source advisory: SNYK:JS-WEBPACK-15235969...

a-gpt (>=0.1.0, <=0.4.0), a11ywatch_cli (>=0.8.16, <=0.10.15) +8955 more potentially affected by CVE-2026-25727 via time (>=0.3.7, <=0.3.29)

time CARGO version =0.3.7, =0.1.0, =0.8.16, =0.3.2, =1.0.3, =0.1.0, =0.11.2, =0.2.0-beta.4, =0.15.1, =0.1.0, =0.0.0, =0.1.0, =0.0.1, =0.1.2 and more Source cves: CVE-2026-25727 Source advisory: OSV:GHSA-R6V5-FH4H-64XC...

@frontmcp/adapters (>=0.5.0, <=0.8.0), @frontmcp/plugin-approval (>=0.7.1, <=0.8.0) +9 more potentially affected by CVE-2026-25533 via enclave-vm (>=1.0.3, <=2.7.0)

enclave-vm NPM version =1.0.3, =0.5.0, =0.7.1, =0.7.1, =0.7.1, =0.7.1, =0.7.1, =0.5.0, =0.5.0, =0.5.0, =0.6.1, =0.8.0 - frontmcp 0.5.0 Source cves: CVE-2026-25533 Source advisory: SNYK:JS-ENCLAVEVM-15248348...

@enclave-vm/broker (>=2.8.0, <=2.10.0), @enclave-vm/runtime (>=2.8.0, <=2.10.0) potentially affected by CVE-2026-25533 via @enclave-vm/core (>=2.8.0, <=2.10.0)

@enclave-vm/core NPM version =2.8.0, =2.8.0, =2.8.0, =2.10.0 Source cves: CVE-2026-25533 Source advisory: SNYK:JS-ENCLAVEVMCORE-15248347...

@enclave-vm/broker (>=2.8.0, <=2.10.0), @enclave-vm/runtime (>=2.8.0, <=2.10.0) potentially affected by CVE-2026-25533 via @enclave-vm/core (>=2.8.0, <=2.10.0)

@enclave-vm/core NPM version =2.8.0, =2.8.0, =2.8.0, =2.10.0 Source cves: CVE-2026-25533 Source advisory: OSV:GHSA-X39W-8VM5-5M3P...

openmls (>=0.4.0-pre.1, <=0.4.0-pre.2), openmls_evercrypt (>=0.1.0-pre.1, <=0.1.0-pre.2) +2 more potentially affected by unknown CVE via hpke-rs (0.1.2)

hpke-rs CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on hpke-rs and may be impacted: - openmls =0.4.0-pre.1, =0.1.0-pre.1, =0.1.0-pre.1, =0.3.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0071...

a-gpt (>=0.1.0, <=0.4.0), a11ywatch_cli (>=0.8.16, <=0.10.15) +8955 more potentially affected by CVE-2026-25727 via time (>=0.3.7, <=0.3.29)

time CARGO version =0.3.7, =0.1.0, =0.8.16, =0.3.2, =1.0.3, =0.1.0, =0.11.2, =0.2.0-beta.4, =0.15.1, =0.1.0, =0.0.0, =0.1.0, =0.0.1, =0.1.2 and more Source cves: CVE-2026-25727 Source advisory: OSV:RUSTSEC-2026-0009...

a-gpt (>=0.1.0, <=0.4.0), abacuz (0.1.1) +1260 more potentially affected by unknown CVE via git2 (>=0.1.21, <=0.19.0)

git2 CARGO version =0.1.21, =0.1.0, =1.1.0, =0.0.1, =0.3.0, =1.0.0, =0.1.0, =0.1.0, =0.3.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-J39J-6GW9-JW6H...

@ai-growth/n8n-nodes-wordpress (>=0.2.0, <=0.6.12), @antonytm/n8n-nodes-test (>=0.1.5, <=0.2.1) +77 more potentially affected by CVE-2026-25631 via n8n-workflow (>=1.0.0, <=1.117.1)

n8n-workflow NPM version =1.0.0, =0.2.0, =0.1.5, =0.0.17, =1.0.2, =1.0.1, =0.2.0, =0.19.0, =0.4.0, =0.11.0, =1.1.0, =1.1.0, =1.1.0, =1.0.1, =1.56.2 and more Source cves: CVE-2026-25631 Source advisory: SNYK:JS-N8NWORKFLOW-15225355...

p2panda-rs (>=0.3.0, <=0.9.0) potentially affected by unknown CVE via openmls (0.4.1)

openmls CARGO version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on openmls and may be impacted: - p2panda-rs =0.3.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8X3W-QJ7J-GQHF...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2115 more potentially affected by CVE-2026-25536 via @modelcontextprotocol/sdk (>=1.10.0, <=1.25.3)

@modelcontextprotocol/sdk NPM version =1.10.0, =0.3.3, =1.0.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.1, =0.0.1, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =10.1.0-rc.1, =10.2.1 and more Source cves: CVE-2026-25536 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLSDK-15208843...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2115 more potentially affected by CVE-2026-25536 via @modelcontextprotocol/sdk (>=1.10.0, <=1.25.3)

@modelcontextprotocol/sdk NPM version =1.10.0, =0.3.3, =1.0.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.1, =0.0.1, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =10.1.0-rc.1, =10.2.1 and more Source cves: CVE-2026-25536 Source advisory: OSV:GHSA-345P-7CG4-V4C7...

@kyuda/n8n-nodes-databricks (>=2.0.0, <=2.0.6), @kyuda/n8n-nodes-databricks-simplified (1.0.0) +14 more potentially affected by CVE-2026-25055 via n8n-workflow (>=2.0.0, <=2.3.1)

n8n-workflow NPM version =2.0.0, =2.0.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.3.1 - n8n-nodes-cheerio-html-parser 0.5.9 and more Source cves: CVE-2026-25055 Source advisory:...

@ai-growth/n8n-nodes-wordpress (>=0.2.0, <=0.6.12), @antonytm/n8n-nodes-test (>=0.1.5, <=0.2.1) +79 more potentially affected by CVE-2026-25055 via n8n-workflow (>=1.0.0, <=1.120.4)

n8n-workflow NPM version =1.0.0, =0.2.0, =0.1.5, =0.0.17, =1.0.2, =1.0.1, =0.2.0, =0.19.0, =0.33.0, =0.4.0, =0.11.0, =0.33.0, =1.1.0, =1.1.0, =1.26.4 and more Source cves: CVE-2026-25055 Source advisory: SNYK:JS-N8NWORKFLOW-15220690...

@n8n/chat (1.2.0) potentially affected by CVE-2026-25054 via @n8n/design-system (2.2.0)

@n8n/design-system NPM version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/design-system and may be impacted: - @n8n/chat 1.2.0 Source cves: CVE-2026-25054 Source advisory: SNYK:JS-N8NDESIGNSYSTEM-15225250...

@n8n/chat (>=1.0.0-rc.0, <=1.1.0) potentially affected by CVE-2026-25054 via @n8n/design-system (>=2.0.0, <=2.1.0)

@n8n/design-system NPM version =2.0.0, =1.0.0-rc.0, =1.1.0 Source cves: CVE-2026-25054 Source advisory: SNYK:JS-N8NDESIGNSYSTEM-15225250...

@like-a-startup/matildex-chat (>=1.0.8, <=1.0.14), @n8n/chat (>=0.46.0, <=0.68.0) +3 more potentially affected by CVE-2026-25054 via @n8n/design-system (>=1.88.0, <=1.110.0)

@n8n/design-system NPM version =1.88.0, =1.0.8, =0.46.0, =1.0.0, =1.0.4 - navis-n8n-chat-ui 1.0.1 Source cves: CVE-2026-25054 Source advisory: SNYK:JS-N8NDESIGNSYSTEM-15225250...

@ai-growth/n8n-nodes-wordpress (>=0.2.0, <=0.6.12), @henry2323/n8n-nodes-calendar-tool-wrapper (0.1.4) +38 more potentially affected by CVE-2026-25052 via n8n-core (>=1.0.0, <=1.122.11)

n8n-core NPM version =1.0.0, =0.2.0, =1.0.1, =0.26.0, =0.34.0, =1.0.1, =0.21.8, =1.0.0, =1.0.0, =0.1.0, =1.0.1, =0.3.3, =0.1.3, =0.1.1, =1.2.0, =1.4.1 and more Source cves: CVE-2026-25052 Source advisory: SNYK:JS-N8NCORE-15223381...

@n8n/backend-test-utils (>=1.0.0-rc.0, <=1.4.3), @n8n/db (>=1.0.0-rc.0, <=1.4.3) +4 more potentially affected by CVE-2026-25052 via n8n-core (>=2.0.0, <=2.4.3)

n8n-core NPM version =2.0.0, =1.0.0-rc.0, =1.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =0.1.0, =0.11.0 Source cves: CVE-2026-25052 Source advisory: SNYK:JS-N8NCORE-15223381...

@ai-growth/n8n-nodes-wordpress (>=0.2.0, <=0.6.12), @henry2323/n8n-nodes-calendar-tool-wrapper (0.1.4) +36 more potentially affected by CVE-2026-25051 via n8n-core (>=1.0.0, <=1.121.1)

n8n-core NPM version =1.0.0, =0.2.0, =1.0.1, =1.0.1, =0.21.8, =1.0.0, =1.0.0, =0.1.0, =1.0.1, =0.3.3, =0.1.3, =0.1.1, =1.2.0, =0.1.1, =0.4.1, =1.1.1 and more Source cves: CVE-2026-25051 Source advisory: SNYK:JS-N8NCORE-15223562...

@n8n/backend-test-utils (0.26.0), @n8n/db (0.34.0) +2 more potentially affected by CVE-2026-25051 via n8n-core (1.122.0)

n8n-core NPM version 1.122.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-core and may be impacted: - @n8n/backend-test-utils 0.26.0 - @n8n/db 0.34.0 - @n8n/task-runner 1.59.0 - n8n-node-dev 1.121.0 Source cves: CVE-2026-25051 Source advisory:...

@n8n/backend-test-utils (>=1.0.0-rc.0, <=1.0.3), @n8n/db (>=1.0.0-rc.0, <=1.0.3) +2 more potentially affected by CVE-2026-25051 via n8n-core (>=2.0.0, <=2.0.2)

n8n-core NPM version =2.0.0, =1.0.0-rc.0, =1.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.1 Source cves: CVE-2026-25051 Source advisory: SNYK:JS-N8NCORE-15223562...

@n8n/ai-workflow-builder (>=1.0.0-rc.0, <=1.3.0), @n8n/api-types (>=1.0.0-rc.0, <=1.3.0) +12 more potentially affected by CVE-2025-68613 +1 more via n8n-workflow (>=2.0.0, <=2.3.0)

n8n-workflow NPM version =2.0.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =0.1.0, =0.11.0 Source cves: CVE-2025-68613, CVE-2026-25049 Source advisory: SNYK:JS-N8NWORKFLOW-15219713...

@ai-growth/n8n-nodes-wordpress (>=0.2.0, <=0.6.12), @antonytm/n8n-nodes-test (>=0.1.5, <=0.2.1) +79 more potentially affected by CVE-2025-68613 +1 more via n8n-workflow (>=1.0.0, <=1.120.3)

n8n-workflow NPM version =1.0.0, =0.2.0, =0.1.5, =0.0.17, =1.0.2, =1.0.1, =0.2.0, =0.19.0, =0.33.0, =0.4.0, =0.11.0, =0.33.0, =1.1.0, =1.1.0, =1.26.3 and more Source cves: CVE-2025-68613, CVE-2026-25049 Source advisory: SNYK:JS-N8NWORKFLOW-15219713...

4m-node-server (>=0.0.1, <=0.0.8), @2109-t5/server (>=1.0.0, <=1.0.9) +989 more potentially affected by CVE-2026-23897 via apollo-server (>=0.1.5, <=3.13.0)

apollo-server NPM version =0.1.5, =0.0.1, =1.0.0, =0.5.0, =0.0.1, =0.1.1, =0.0.1, =1.0.7, =0.4.0-alpha.0, =10.4.0, =9.0.0, =10.0.0, =11.2.0 and more Source cves: CVE-2026-23897 Source advisory: SNYK:JS-APOLLOSERVER-15208674...

@akanjs/config (>=0.0.4, <=0.0.16), @akanjs/nest (>=0.0.4, <=0.0.16) +95 more potentially affected by CVE-2026-23897 via @apollo/server (>=4.2.0, <=4.12.2-alpha.0)

@apollo/server NPM version =4.2.0, =0.0.4, =0.0.4, =0.0.4, =1.1.1, =4.2.0, =0.0.1, =2.0.8, =0.2.0, =0.0.2, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.8.8, =1.93.0, =1.216.0 and more Source cves: CVE-2026-23897 Source advisory: OSV:GHSA-MP6Q-XF9X-FWF7...