@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53820 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53820 Source advisory: SNYK:JS-OPENCLAW-17339341...

@lifesg/web-frontend-engine (>=2.2.4, <=2.2.5), @osdlabel/react (0.0.1) +2 more potentially affected by CVE-2026-44311 via fabric (>=7.1.0, <=7.2.0)

fabric NPM version =7.1.0, =2.2.4, =2.2.5 - @osdlabel/react 0.0.1 - @osdlabel/solid 0.0.1 - osdlabel 0.0.1 Source cves: CVE-2026-44311 Source advisory: OSV:GHSA-W22M-HVVM-XMWX...

7ghost-cli (>=1.17.6-next.0, <=1.18.4), @5ht/express (>=1.0.6, <=2.2.0) +650 more potentially affected by CVE-2026-12143 via form-data (>=3.0.0, <=3.0.4)

form-data NPM version =3.0.0, =1.17.6-next.0, =1.0.6, =1.0.0, =0.12.4, =1.1.3, =1.9.19, =1.1.0, =1.18.0, =2.13.1, =1.1.0, =10.1.0, =1.0.0, =1.9.2, =2.1.4 and more Source cves: CVE-2026-12143 Source advisory: SNYK:JS-FORMDATA-17337015...

10secondsofcode-custom (1.0.0), 1kohei1 (>=1.0.0, <=1.0.1) +8234 more potentially affected by CVE-2026-12143 via form-data (>=4.0.0, <=4.0.5)

form-data NPM version =4.0.0, =1.0.0, =1.2.0, =1.0.0, =0.1.0, =0.0.1, =0.1.1, =5.0.0, =0.0.1, =1.0.1, =1.0.32, =1.0.32, =1.1.11 and more Source cves: CVE-2026-12143 Source advisory: SNYK:JS-FORMDATA-17337015...

01os (>=0.0.5, <=0.0.13), 1claw-crewai-tools (>=0.1.0, <=0.2.0) +2063 more potentially affected by CVE-2026-45831 via chromadb (>=0.3.4, <=1.5.9)

chromadb PYPI version =0.3.4, =0.0.5, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.2.0, =0.6.4, =0.1.1, =0.0.4.dev0, =0.0.4 - adaline-crewai 0.1.0 and more Source cves: CVE-2026-45831 Source advisory: SNYK:PYTHON-CHROMADB-17337045...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +90 more potentially affected by CVE-2026-53722 via nuxt (>=3.0.0, <=3.20.1)

nuxt NPM version =3.0.0, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.1.3, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =10.0.2-rc.4 and more Source cves: CVE-2026-53722 Source advisory: SNYK:JS-NUXT-17328106...

Exploit for CVE-2026-46645

CVE-2026-46645 - SQLAdmin ajaxlookup Authorization Bypass...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53815 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53815 Source advisory: SNYK:JS-OPENCLAW-17398168...

CVE-2026-12008

Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

@1xtr/yc-log-client (>=1.0.6, <=1.1.1), @a11ywatch/a11ywatch (>=0.2.126, <=0.3.82) +126 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.10.0, <=1.10.11)

@grpc/grpc-js NPM version =1.10.0, =1.0.6, =0.2.126, =0.8.16, =0.9.58, =4.4.29, =3.1.9, =0.78.0, =1.68.0, =5.7.3, =1.26.5, =8.5.1-alpha.4, =0.1.22, =3.5.2, =3.5.5 and more Source cves: CVE-2026-48068 Source advisory: SNYK:JS-GRPCGRPCJS-17315646...

@alenon/grpc-mock-server (>=3.1.14, <=3.1.15), @aliceo2/bookkeeping (>=0.96.0, <=1.0.1) +84 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.11.0, <=1.11.3)

@grpc/grpc-js NPM version =1.11.0, =3.1.14, =0.96.0, =1.71.0, =0.0.10, =0.0.13, =0.0.10, =0.0.19, =0.0.10, =1.29.0, =0.1.0, =0.1.0, =0.2.5 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

Exploit for CVE-2026-48907

CVE-2026-48907 Educational PoC ⚠️ This repository is for ed...

CVE-2026-2827

The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oumlocationnotification' parameter in versions up to, and including, 1.4.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

@fedify/cli (>=2.2.0-dev.898, <=2.2.3), @fedify/fedify (>=2.2.0-dev.606, <=2.2.3) +3 more potentially affected by CVE-2026-50131 via @fedify/vocab-runtime (>=2.2.0, <=2.2.3-dev.1098)

@fedify/vocab-runtime NPM version =2.2.0, =2.2.0-dev.898, =2.2.0-dev.606, =2.2.0-dev.606, =2.2.0-dev.606, =2.2.0-dev.606, =2.2.3 Source cves: CVE-2026-50131 Source advisory: SNYK:JS-FEDIFYVOCABRUNTIME-17954863...

@fedify/cli (>=2.2.0-dev.898, <=2.2.3) potentially affected by CVE-2026-50131 via @fedify/fedify (>=2.2.0, <=2.2.3-dev.1098)

@fedify/fedify NPM version =2.2.0, =2.2.0-dev.898, =2.2.3 Source cves: CVE-2026-50131 Source advisory: SNYK:JS-FEDIFYFEDIFY-17954864...

@hulumi/platform-patterns (>=0.0.0-bootstrap.0, <=1.3.2) potentially affected by CVE-2026-48037 via @hulumi/baseline (>=1.3.1, <=1.3.2)

@hulumi/baseline NPM version =1.3.1, =0.0.0-bootstrap.0, =1.3.2 Source cves: CVE-2026-48037 Source advisory: OSV:GHSA-CJ8G-PRCM-MFG5...

@hulumi/platform-patterns (>=0.0.0-bootstrap.0, <=1.3.2) potentially affected by CVE-2026-48035 via @hulumi/baseline (>=1.3.1, <=1.3.2)

@hulumi/baseline NPM version =1.3.1, =0.0.0-bootstrap.0, =1.3.2 Source cves: CVE-2026-48035 Source advisory: SNYK:JS-HULUMIBASELINE-17660549...

CVE-2026-48251

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser...

CVE-2026-47900 Stored XSS via Unsanitized Plugin Metadata in Logseq

Logseq is vulnerable to a stored cross-site scripting XSS. A malicious plugin can include a JavaScript payload in the "name" field of its "package.json" file, which is rendered using "innerHTML" without proper sanitization, allowing the execution of arbitrary code in the privileged host context...

CVE-2026-47899

CVE-2026-47899 affects Logseq via the Electron preload script, where an API method allows the renderer to invoke IPC handlers without proper path validation. This enables a JavaScript-executing attacker (e.g., via XSS or a malicious plugin) to read, write, or delete arbitrary files on the user’s ...