langchain-nebius (>=0.1.0, <=0.1.2), sugardata (>=0.0.2, <=0.0.5) potentially affected by CVE-2026-41488 via langchain-openai (0.3.5)

langchain-openai PYPI version 0.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - langchain-nebius =0.1.0, =0.0.2, =0.0.5 Source cves: CVE-2026-41488 Source advisory: OSV:GHSA-R7W7-9XR2-QQ2R...

bisheng-langchain (>=0.3.4, <=0.3.7.1), bsrag-langchain (0.3.8.0) +1 more potentially affected by CVE-2026-41488 via langchain-openai (0.1.5)

langchain-openai PYPI version 0.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - bisheng-langchain =0.3.4, =0.1.4, =0.1.7 Source cves: CVE-2026-41488 Source advisory: OSV:GHSA-R7W7-9XR2-QQ2R...

addepar-redflag (>=0.1.0, <=1.2.0), agentbruno (>=0.0.2, <=0.0.5) +183 more potentially affected by CVE-2026-41481 via langchain-text-splitters (0.0.2)

langchain-text-splitters PYPI version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-text-splitters and may be impacted: - addepar-redflag =0.1.0, =0.0.2, =0.1.0, =0.0.8.dev1, =0.0.1, =0.19.0, =0.1.0, =0.1.0, =0.8.29, =0.0.1, =0.0.1,...

aa-rag (>=0.1.0, <=0.4.1), aiagents4pharma (>=1.8.2, <=1.22.3) +10 more potentially affected by CVE-2026-41481 via langchain-text-splitters (0.3.5)

langchain-text-splitters PYPI version 0.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-text-splitters and may be impacted: - aa-rag =0.1.0, =1.8.2, =1.0.0, =0.0.3, =0.0.2, =25.7.1.0, =0.3.0, =0.7.0, =0.1.1, =0.6.51, =0.0.30, =0.0.33 Sour...

companies.sh (>=2026.324.0-canary.0, <=2026.325.0-canary.3) potentially affected by unknown CVE via paperclipai (2026.324.0-canary.7)

paperclipai NPM version 2026.324.0-canary.7 is affected by a known vulnerability. The following packages have a transitive dependency on paperclipai and may be impacted: - companies.sh =2026.324.0-canary.0, =2026.325.0-canary.3 Source cves: unknown CVE Source advisory: OSV:GHSA-GQQJ-85QM-8QHF...

@budibase/cli (>=3.0.0, <=3.2.26), @budibase/pro (>=3.0.0, <=3.2.26) +2 more potentially affected by CVE-2026-41428 via @budibase/backend-core (>=3.0.0, <=3.2.26)

@budibase/backend-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-41428 Source advisory: OSV:GHSA-8783-3WGF-JGGF...

@budibase/cli (>=3.0.0, <=3.2.26), @budibase/pro (>=3.0.0, <=3.2.26) +2 more potentially affected by CVE-2026-41428 via @budibase/backend-core (>=3.0.0, <=3.2.26)

@budibase/backend-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-41428 Source advisory: SNYK:JS-BUDIBASEBACKENDCORE-16115495...

@20syldev/api (>=2.6.0, <=2.8.0), @aalis/plugin-tool-math (>=0.1.0, <=0.12.0) +504 more potentially affected by CVE-2026-40897 via mathjs (>=13.1.1, <=15.1.1)

mathjs NPM version =13.1.1, =2.6.0, =0.1.0, =1.3.0, =2.0.0, =0.2.6, =0.3.0, =7.0.0, =7.0.0, =0.1.14, =0.13.1, =5.0.95, =1.0.0, =1.3.0-alpha.0 - @antsoo-lib/components 0.0.1 - @antsoo-lib/hooks 0.0.1 and more Source cves: CVE-2026-40897 Source advisory: OSV:GHSA-29QV-4J9F-FJW5...

@20syldev/api (>=2.6.0, <=2.8.0), @aalis/plugin-tool-math (>=0.1.0, <=0.12.0) +504 more potentially affected by CVE-2026-40897 via mathjs (>=13.1.1, <=15.1.1)

mathjs NPM version =13.1.1, =2.6.0, =0.1.0, =1.3.0, =2.0.0, =0.2.6, =0.3.0, =7.0.0, =7.0.0, =0.1.14, =0.13.1, =5.0.95, =1.0.0, =1.3.0-alpha.0 - @antsoo-lib/components 0.0.1 - @antsoo-lib/hooks 0.0.1 and more Source cves: CVE-2026-40897 Source advisory: SNYK:JS-MATHJS-16097976...

@cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4), @irshadali/ngx-indexed-db (>=19.3.0, <=19.3.1) +16 more potentially affected by CVE-2026-41423 via @angular/platform-server (>=18.2.13, <=18.2.14)

@angular/platform-server NPM version =18.2.13, =1.0.0, =19.3.0, =0.0.0, =12.0.0, =0.0.0, =1.0.2, =0.0.0, =1.0.0, =0.0.1, =0.0.2 - my-unique-workspace 0.0.0 - my-workspace01 0.0.0 and more Source cves: CVE-2026-41423 Source advisory: OSV:GHSA-45Q2-GJVG-7973...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-exui-4425, <=4.2.17) +1 more potentially affected by CVE-2026-41423 via @angular/platform-server (>=20.0.0, <=20.3.18)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-exui-4425, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-41423 Source advisory: OSV:GHSA-45Q2-GJVG-7973...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-41423 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-41423 Source advisory: OSV:GHSA-45Q2-GJVG-7973...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-41423 via @angular/platform-server (>=21.1.2, <=21.2.0)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-41423 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-16097942...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-41423 via @angular/platform-server (>=21.1.2, <=21.2.0)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-41423 Source advisory: OSV:GHSA-45Q2-GJVG-7973...

org.webjars.npm:bazel__typescript (1.7.0), org.webjars.npm:cesium (>=1.96.0, <=1.144.0) +13 more potentially affected by CVE-2026-41242 via org.webjars.npm:protobufjs (>=6.8.8, <=8.7.2)

org.webjars.npm:protobufjs MAVEN version =6.8.8, =1.96.0, =1.0.0, =1.0.0, =10.13.0, =4.7.0, =0.3.35, =1.6.1, =0.5.2, =0.7.15 - org.webjars.npm:tiktok-live-connector 1.0.2 Source cves: CVE-2026-41242 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16094666...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3366 more potentially affected by CVE-2026-41242 via protobufjs (>=7.0.0, <=7.5.4)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =4.0.1 and more Source cves: CVE-2026-41242 Source advisory: SNYK:JS-PROTOBUFJS-16094665...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @42zeroo/tescik (>=1.0.0, <=1.1.1963) +710 more potentially affected by CVE-2026-41242 via protobufjs (8.0.0)

protobufjs NPM version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobufjs and may be impacted: - @0xchain/telemetry =1.1.0-beta.8, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.6.0, =0.8.0 - @adaptic/backend-legacy 0.0.941 and more...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3366 more potentially affected by CVE-2026-41242 via protobufjs (>=7.0.0, <=7.5.4)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =4.0.1 and more Source cves: CVE-2026-41242 Source advisory: OSV:GHSA-XQ3M-2V4X-88GG...

2mxdev-gql-gateway (1.0.0), 4m-node-server (>=0.0.1, <=0.0.8) +2887 more potentially affected by CVE-2026-41242 via @apollo/protobufjs (>=1.1.0, <=1.2.7)

@apollo/protobufjs NPM version =1.1.0, =0.0.1, =1.0.2, =3.10.1, =1.2.0-pre.24, =1.0.1, =1.0.0, =1.0.0, =0.5.0, =1.0.0, =0.0.1, =0.1.1, =0.0.1, =1.0.7, =1.0.17 and more Source cves: CVE-2026-41242 Source advisory: SNYK:JS-APOLLOPROTOBUFJS-16321047...

3id-test-helper (>=1.0.0, <=1.0.4), @00ssh/erdnest (>=0.2.19, <=0.2.23) +3561 more potentially affected by CVE-2026-41242 via protobufjs (>=6.8.0, <=6.11.4)

protobufjs NPM version =6.8.0, =1.0.0, =0.2.19, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =2.1.0, =0.0.8-alpha.0, =0.1.0, =0.0.2, =0.0.1, =1.0.7, =1.0.13 - @account-coddle/pokerfire 0.0.1 and more Source cves: CVE-2026-41242 Source advisory: SNYK:JS-PROTOBUFJS-16094665...