@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +244 more potentially affected by CVE-2026-101916 via @grpc/grpc-js (>=1.14.0, <=1.14.4)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =0.26.4, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.1.0, =2.2.2, =2.0.0, =0.0.4, =0.0.35 and more Source cves: CVE-2026-101916 Source advisory: MEND:CVE-2026-101916...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +244 more potentially affected by CVE-2026-101915 via @grpc/grpc-js (>=1.14.0, <=1.14.4)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =0.26.4, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.1.0, =2.2.2, =2.0.0, =0.0.4, =0.0.35 and more Source cves: CVE-2026-101915 Source advisory: MEND:CVE-2026-101915...

@aikidosec/broker-client (1.0.51), @app4you/n8n-nodes-portal-invoices (>=0.3.1, <=0.3.11) +43 more potentially affected by CVE-2026-101910 via ip-address (>=10.2.0, <=10.5.0)

ip-address NPM version =10.2.0, =0.3.1, =1.5.40, =1.6.0, =4.2.2, =0.17.1, =2.7.9, =4.0.3, =3.1.58, =2.6.55, =3.7.6, =2.7.130, =3.1.50, =4.0.4, =4.0.27 and more Source cves: CVE-2026-101910 Source advisory: SNYK:JS-IPADDRESS-20250985...

-price-checker (>=1.0.0, <=1.0.5), 01_use_npm (1.0.0) +22189 more potentially affected by CVE-2026-101902 via axios (>=0.27.2, <=0.33.0)

axios NPM version =0.27.2, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vector-search 0.1.0 - 0g-vibekit 0.1.0 and more Source cves: CVE-2026-101902 Source advisory: SNYK:JS-AXIOS-20245050...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +18207 more potentially affected by CVE-2026-101902 via axios (>=1.0.0, <=1.19.0)

axios NPM version =1.0.0, =0.0.8, =0.0.0-20251106131028, =1.0.53, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-101902 Source advisory: SNYK:JS-AXIOS-20245050...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 123pancli (1.0.0) +4097 more potentially affected by CVE-2026-101905 via axios (>=1.15.2, <=1.19.0)

axios NPM version =1.15.2, =0.0.0-20251106131028, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.1.3-rc.0, =1.2.3 and mo...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +18207 more potentially affected by CVE-2026-101904 via axios (>=1.0.0, <=1.19.0)

axios NPM version =1.0.0, =0.0.8, =0.0.0-20251106131028, =1.0.53, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-101904 Source advisory: SNYK:JS-AXIOS-20244996...

MAL-2026-17229 Malicious code in simple-date-formatter-new-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f npm package [email protected] declares a postinstall lifecycle script in package.json that runs automatically on npm install. The...

Malicious code in simple-date-formatter-new-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f npm package [email protected] declares a postinstall lifecycle script in package.json that runs automatically on npm install. The...

@aikidosec/broker-client (1.0.51), @app4you/n8n-nodes-portal-invoices (>=0.3.1, <=0.3.11) +43 more potentially affected by CVE-2026-101910 via ip-address (>=10.2.0, <=10.5.0)

ip-address NPM version =10.2.0, =0.3.1, =1.5.40, =1.6.0, =4.2.2, =0.17.1, =2.7.9, =4.0.3, =3.1.58, =2.6.55, =3.7.6, =2.7.130, =3.1.50, =4.0.4, =4.0.27 and more Source cves: CVE-2026-101910 Source advisory: MEND:CVE-2026-101910...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +13595 more potentially affected by CVE-2026-101908 via axios (>=1.7.0, <=1.19.0)

axios NPM version =1.7.0, =0.0.8, =0.0.0-20251106131028, =1.0.53, =0.1.0, =1.0.0, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-101908 Source advisory: MEND:CVE-2026-101908...

@a-rt-works/auth0-deploy-cli (3.3.3), @acknow-srl/express-openid (>=1.0.0, <=1.0.1) +564 more potentially affected by CVE-2026-101906 via axios (>=0.31.0, <=0.33.0)

axios NPM version =0.31.0, =1.0.0, =0.0.1, =0.0.2, =1.3.2, =3.201.4, =0.2.0, =0.0.2-beta.0, =2.0.14, =0.5.12, =1.0.0, =1.0.1, =1.0.4 and more Source cves: CVE-2026-101906 Source advisory: MEND:CVE-2026-101906...

0xpay-cc-sdk (>=0.0.8, <=0.1.0), 0xtrails (>=0.0.0-20251106131028, <=0.19.1) +8477 more potentially affected by CVE-2026-101900 via axios (>=1.12.0, <=1.19.0)

axios NPM version =1.12.0, =0.0.8, =0.0.0-20251106131028, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.2.8 and more Source cves: CVE-2026-101900 Source advisory:...

@aico-test/android-playground (>=10.0.0, <=11.0.0), @area15/ticket-component (0.1.0) +57 more potentially affected by CVE-2026-101894 via @xhmikosr/decompress (>=5.0.0, <=10.0.1)

@xhmikosr/decompress NPM version =5.0.0, =10.0.0, =0.0.0, =0.100.8, =0.100.8, =0.100.8, =0.100.8, =0.102.0, =0.29.0-alpha.2, =4.0.1, =9.0.0, =0.0.0-a2a-20250421213654, =0.14.1-beta-20250403090809.0, =0.14.4-beta-20250414114024.0 and more Source cves: CVE-2026-101894 Source advisory:...

MAL-2026-17215 Malicious code in eslint-plugin-skywagon-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c5d134d2e79b24ed65d2998520db05b5cc86b251ae579a6d8cec6d8fe02340f [email protected] ships an index.js that is executed via a preinstall lifecycle script on npm install. The script collects...

Malicious code in eslint-plugin-skywagon-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c5d134d2e79b24ed65d2998520db05b5cc86b251ae579a6d8cec6d8fe02340f [email protected] ships an index.js that is executed via a preinstall lifecycle script on npm install. The script collects...

@budibase/backend-core (>=0.0.999-alpha.30, <=3.2.26), @budibase/bbui (>=0.0.999-alpha.30, <=3.2.26) +9 more potentially affected by CVE-2026-61834 via scim-patch (>=0.7.1, <=0.8.3)

scim-patch NPM version =0.7.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =1.0.11, =1.2.1 Source cves: CVE-2026-61834 Source advisory: GHSA-2MHW-WCX5-V3XJ...

CVE-2026-93268

A flaw was found in the Linux kernel's ext4 file system. When mounting a file system, expanding extended attribute storage while holding an active journal lock can create a circular locking dependency. A local user capable of mounting or triggering file system recovery operations could exploit th...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +10 more potentially affected by CVE-2026-101043 via pnpm (>=10.8.1, <=10.33.0)

pnpm NPM version =10.8.1, =0.1.0, =1.1.1, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-101043 Source advisory: MEND:CVE-2026-101043...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +287 more potentially affected by CVE-2026-100722 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...