ROOT-APP-NPM-CVE-2025-47949 CVE-2025-47949 in samlify - Patched by Root

Root has patched CVE-2025-47949 in the samlify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-46490 CVE-2026-46490 in samlify - Patched by Root

Root has patched CVE-2026-46490 in the samlify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-82333 CVE-2026-82333 in multer - Patched by Root

Root has patched CVE-2026-82333 in the multer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-77078 CVE-2026-77078 in multer - Patched by Root

Root has patched CVE-2026-77078 in the multer package for Root:npm. Multiple fixed versions available...

MAL-2026-17369 Malicious code in @noxleyss/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17310 Malicious code in tailwind-forms-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea npm package [email protected] impersonates the @tailwindcss/forms plugin: the package.json name field is ' tailwind-forms-kit' with a leading...

@01.software/cli (>=0.1.1, <=0.10.3), @01.software/sdk (>=0.0.1-251008.90016, <=0.29.0) +2064 more potentially affected by CVE-2026-85008 via undici (>=7.0.0, <=7.29.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =1.0.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.0.6, =1.0.0, =1.52.3 and more Source cves: CVE-2026-85008 Source advisory: OSV:GHSA-8436-99HF-9MMV...

@0x-copilot/cli (>=0.2.1, <=0.3.0), @ascua/electron (>=0.19.0, <=0.26.0) +30 more potentially affected by CVE-2026-102676 via electron (>=43.0.0, <=43.4.0)

electron NPM version =43.0.0, =0.2.1, =0.19.0, =0.1.0, =9.10.29-beta.1, =9.10.29-beta.1, =6.7.0, =0.4.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.208, =1.3.9 and more Source cves: CVE-2026-102676 Source advisory: SNYK:JS-ELECTRON-20335447...

@0x-copilot/cli (>=0.2.1, <=0.3.0), @ascua/electron (>=0.19.0, <=0.26.0) +35 more potentially affected by CVE-2026-102677 via electron (>=43.0.0, <=43.4.1)

electron NPM version =43.0.0, =0.2.1, =0.19.0, =0.1.0, =9.10.29-beta.1, =9.10.29-beta.1, =6.7.0, =0.4.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 - @sharpcaterpillar/pi-web 0.8.11 and more Source cves: CVE-2026-102677 Source advisory: SNYK:JS-ELECTRON-20335433...

ROOT-APP-NPM-CVE-2026-44288 CVE-2026-44288 in protobufjs - Patched by Root

Root has patched CVE-2026-44288 in the protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-71329 CVE-2025-71329 in image-size - Patched by Root

Root has patched CVE-2025-71329 in the image-size package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-71319 CVE-2025-71319 in image-size - Patched by Root

Root has patched CVE-2025-71319 in the image-size package for Root:npm. Multiple fixed versions available...

20231122-npm (1.0.0), 2048.io (0.0.1) +6536 more potentially affected by CVE-2026-87859 via morgan (>=1.0.0, <=1.12.0)

morgan NPM version =1.0.0, =1.0.2, =1.0.0, =0.2.0, =0.0.1, =1.0.0, =0.2.0, =0.0.1, =0.0.1-bate.30, =0.0.1, =0.0.67 and more Source cves: CVE-2026-87859 Source advisory: OSV:GHSA-9F6G-J8CH-79G4...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @aikidosec/broker-client (>=0.0.2, <=1.0.51) +135 more potentially affected by CVE-2026-101913 via ip-address (>=10.0.1, <=10.5.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.31, =7.0.0-canary.2, =7.5.9 and more Source cves: CVE-2026-101913 Source advisory: SNYK:JS-IPADDRESS-20250964...

EUVD-2026-88239

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request...

ROOT-APP-NPM-GHSA-8H8Q-6873-Q5FJ GHSA-8h8q-6873-q5fj in next - Patched by Root

Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available...

@0xwork/connect (>=0.1.0, <=0.1.9), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +31 more potentially affected by CVE-2026-100529 via openclaw (>=2026.3.22, <=2026.7.1-2)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =1.1.50, =27.2.5, =1.1.0, =2.1.3, =2.2.0 - @susulabs/openclaw-gralkor 2.1.3 and more Source cves: CVE-2026-100529 Source advisory: SNYK:JS-OPENCLAW-20186835...

CVE-2026-100588

OpenClaw npm package 'openclaw' before 2026.7.1 does not enforce the administrator scope requirement on browser control when it is reached through the node.invoke method, although direct browser.request access requires administrator scope. In Gateway deployments that honor caller identity and...

CVE-2026-100578

OpenClaw npm package openclaw before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn...

CVE-2026-100579

OpenClaw npm package 'openclaw' before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments authentication modes that honor caller identity and narrower operator scopes, a write-scoped caller can supply another sender's identifier to the...