@27works/posto (>=1.0.0, <=2.0.2), @abc45676/mailer (1.0.0) +316 more potentially affected by unknown CVE via nodemailer (>=8.0.0, <=8.0.8)

nodemailer NPM version =8.0.0, =1.0.0, =0.12.2, =0.5.3, =0.4.1, =2.0.2, =3.19.2, =0.0.1, =0.0.10, =1.0.0, =0.0.1, =1.0.0, =2.4.0, =2.1.108, =0.0.1, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WQVQ-JVPQ-H66F...

@flutchai/flutch-sdk (>=0.2.7, <=0.5.0) potentially affected by CVE-2026-48121 via @langchain/langgraph-checkpoint-mongodb (1.0.0)

@langchain/langgraph-checkpoint-mongodb NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @langchain/langgraph-checkpoint-mongodb and may be impacted: - @flutchai/flutch-sdk =0.2.7, =0.5.0 Source cves: CVE-2026-48121 Source advisory:...

@hulumi/platform-patterns (>=0.0.0-bootstrap.0, <=1.3.2) potentially affected by CVE-2026-48035 via @hulumi/baseline (>=1.3.1, <=1.3.2)

@hulumi/baseline NPM version =1.3.1, =0.0.0-bootstrap.0, =1.3.2 Source cves: CVE-2026-48035 Source advisory: OSV:GHSA-2MXR-P26X-MJ73...

org.hswebframework.web:hsweb-system-authorization-oauth2 (>=4.0.8, <=5.0.1) potentially affected by CVE-2026-11477 via org.hswebframework.web:hsweb-authorization-oauth2 (>=4.0.8, <=5.0.1)

org.hswebframework.web:hsweb-authorization-oauth2 MAVEN version =4.0.8, =4.0.8, =5.0.1 Source cves: CVE-2026-11477 Source advisory: SNYK:JAVA-ORGHSWEBFRAMEWORKWEB-17232077...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16283 more potentially affected by CVE-2026-44496 via axios (>=1.0.0, <=1.15.2)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-44496 Source advisory: OSV:GHSA-HFXV-24RG-XRQF...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-32906 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-32906 Source advisory: SNYK:JS-OPENCLAW-17099288...

@andrewcturing/todoist (0.0.1), @bento-core/navigator (1.0.0) +57 more potentially affected by CVE-2026-9673 via json-2-csv (>=3.20.0, <=5.5.10)

json-2-csv NPM version =3.20.0, =1.8.0, =5.0.2, =0.0.1, =0.2.3, =0.1.0, =0.1.0, =0.5.1, =1.0.2, =1.3.1, =1.3.1-next.0, =1.4.0, =2.0.1 and more Source cves: CVE-2026-9673 Source advisory: OSV:GHSA-G27C-Q7CP-MHX6...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +187 more potentially affected by unknown CVE via better-auth (>=1.0.0, <=1.6.1)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.0.7, =1.0.0-canary.2, =1.3.27, =1.3.37 and more Source cves: unknown CVE Source advisory: SNYK:JS-BETTERAUTH-16722768...

acegisecurity:acegi-security-catalina (>=0.7.0, <=0.9.0), ch.qos.logback:logback-access (>=${parent.version}, <=0.8) +40 more potentially affected by CVE-2026-43515 via tomcat:catalina (>=4.0.6, <=5.5.23)

tomcat:catalina MAVEN version =4.0.6, =0.7.0, =$parent.version, =0.6, =3.2.10-1-sp3seam2hibernate5, =1.5, =1.0-m5, =1.0-m5, =1.0.0-rc1, =4.7.1, =4.7.2 - org.apache.geronimo.assemblies:geronimo-tomcat-minimal 1.2-beta - org.apache.geronimo.configs:ca-helper-tomcat 1.2-beta -...

@elliemae/pui-e2e-test-sdk (>=11.0.0, <=12.2.0), froth-webdriverio-framework (>=7.0.119-dev1.0, <=9.0.6-ytlc7.5) potentially affected by CVE-2026-25244 via @wdio/browserstack-service (>=9.12.7, <=9.23.0)

@wdio/browserstack-service NPM version =9.12.7, =11.0.0, =7.0.119-dev1.0, =9.0.6-ytlc7.5 Source cves: CVE-2026-25244 Source advisory: OSV:GHSA-5C46-X3QW-Q7J7...

@algotech-ce/business (>=1.0.1445, <=6.0.28), @algotech-ce/interpretor (>=2.0.0, <=6.0.19) +22 more potentially affected by CVE-2026-44643 via angular-expressions (>=1.0.0, <=1.5.1)

angular-expressions NPM version =1.0.0, =1.0.1445, =2.0.0, =0.1.0, =0.6.0-bootstrap.0, =0.6.0-bootstrap.0, =0.6.0-bootstrap.0, =0.6.0-bootstrap.0, =0.6.0-bootstrap.0, =0.6.0-bootstrap.0, =0.6.0-bootstrap.0, =0.6.0-bootstrap.0, =0.6.0-bootstrap.0, =0.6.0-bootstrap.0, =0.6.0-bootstrap.0, =0.6.0 and...

0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2298 more potentially affected by CVE-2026-44902 via @opentelemetry/exporter-prometheus (>=0.9.0, <=0.216.0)

@opentelemetry/exporter-prometheus NPM version =0.9.0, =0.1.0, =0.1.0-dev.00aaa03, =0.1.1, =0.1.0, =0.0.1, =1.0.21, =0.0.1, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.0.68 and more Source cves: CVE-2026-44902 Source advisor...

armature-diesel (0.1.0), authzen (0.1.0-alpha.0) +21 more potentially affected by unknown CVE via diesel-async (>=0.1.1, <=0.6.1)

diesel-async CARGO version =0.1.1, =0.1.0, =0.18.0-rc.4, =0.18.0-rc.4, =0.18.0-rc.4, =0.18.0-rc.4, =0.17.0, =0.17.0, =0.19.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-FF9Q-RM55-Q7QR...

@datalayer/jupyter-react (>=0.0.6, <=0.9.5), @mrawdon/jupyter-react (>=0.0.23, <=0.0.32) potentially affected by CVE-2026-42557 via @jupyterlab/rendermime-extension (>=4.0.0, <=4.1.0-beta.0)

@jupyterlab/rendermime-extension NPM version =4.0.0, =0.0.6, =0.0.23, =0.0.32 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABRENDERMIMEEXTENSION-16438958...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +283 more potentially affected by CVE-2026-26332 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-41908 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-41908 Source advisory: OSV:GHSA-V8QF-FR4G-28P2...

locizify (>=7.0.0, <=9.0.9), locizify-ssg (>=1.1.12, <=2.0.6) potentially affected by CVE-2026-41692 via i18nextify (>=4.0.0, <=4.0.7)

i18nextify NPM version =4.0.0, =7.0.0, =1.1.12, =2.0.6 Source cves: CVE-2026-41692 Source advisory: OSV:GHSA-6457-MXPQ-4FQQ...

@chocolatey-software/astro (2.7.0), @kyro-cms/admin (0.1.2) +8 more potentially affected by CVE-2026-41067 via astro (>=6.0.0-beta.1, <=6.1.5)

astro NPM version =6.0.0-beta.1, =0.19.0, =0.19.0, =1.10.0, =1.0.0, =1.4.2, =0.0.1, =0.0.1, =0.0.7 Source cves: CVE-2026-41067 Source advisory: OSV:GHSA-J687-52P2-XCFF...

@grupo-loja/vendure-banner-plugin (1.0.0), @grupo-loja/vendure-conect-envios-plugin (>=1.0.0, <=1.0.1) +54 more potentially affected by CVE-2026-40887 via @vendure/core (>=1.9.5, <=2.2.7)

@vendure/core NPM version =1.9.5, =1.0.0, =0.0.1, =1.0.3, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.2.4 and more Source cves: CVE-2026-40887 Source advisory: OSV:GHSA-9PP3-53P2-WW9V...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +18 more potentially affected by CVE-2026-42429 via openclaw (>=2026.3.22, <=2026.4.5)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =4.2.0 - openclaw-chatclaw 0.1.0 and more Source cves: CVE-2026-42429 Source advisory: OSV:GHSA-4F8G-77MW-3RXC...