0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2059 more potentially affected by CVE-2026-2229 via undici (>=6.0.0, <=6.23.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =0.5.21-beta.0, =0.5.43 and more Source cves: CVE-2026-2229 Source advisory: SNYK:JS-UNDICI-15518070...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.13-next.1) +11 more potentially affected by CVE-2026-32235 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.27.0-next.1)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748, =1.0.0,...

@228-fund/elysia-effect (0.0.1), @228-fund/elysia-msgpack (>=0.0.1, <=0.0.3) +66 more potentially affected by CVE-2026-30837 via elysia (>=1.0.9, <=1.4.22)

elysia NPM version =1.0.9, =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.4, =0.1.0, =0.1.0-next.4, =1.0.0-next.4, =1.0.0, =0.0.1, =1.0.3, =1.0.10 and more Source cves: CVE-2026-30837 Source advisory: SNYK:JS-ELYSIA-15469934...

3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +481 more potentially affected by CVE-2026-28292 via simple-git (>=3.15.0, <=3.32.2)

simple-git NPM version =3.15.0, =1.0.1, =1.0.1, =0.0.0-aj-beta.7, =23.0.0, =35.0.0, =1.4.0, =0.1.5-alpha.0, =1.0.2, =8.7.2, =39.0.2, =0.0.1, =0.0.8 and more Source cves: CVE-2026-28292 Source advisory: OSV:GHSA-R275-FR43-PM7Q...

OpenClaw safeBins grep -e File Read Bypass (stdin-only policy bypass)

Summary OpenClaw tools.exec.safeBins had a stdin-only policy bypass for grep. If pattern input was supplied through -e / --regexp, the validator consumed the pattern as a flag value and still allowed one positional operand. That positional could be a bare filename like .env. Affected Packages /...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.7.1) +11 more potentially affected by CVE-2026-2880 via @fastify/middie (>=9.0.2, <=9.1.0)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.48 Source cves: CVE-2026-2880 Source advisory: OSV:GHSA-8P85-9QPW-FWGW...

@0x590fab/sdcor2 (>=4.2.1, <=4.4.0), @cenk1cenk2/renovate-config (>=2.2.33, <=2.3.94) +22 more potentially affected by CVE-2026-27903 via minimatch (>=6.0.0, <=6.2.0)

minimatch NPM version =6.0.0, =4.2.1, =2.2.33, =0.2.6-alpha-20230114225627-66f5d9eac, =0.1.7-alpha-20230114225627-66f5d9eac, =0.15.7-alpha-20230114225627-66f5d9eac, =0.1.0, =3.108.8--canary.1.4727068200.0, =0.0.0, =1.12.0, =1.0.0-beta.13, =0.36.6-0, =0.36.6-0, =0.39.3-0 - editorconfig 1.0.2 and...

0.2-ui (0.0.1), 1k-tasks (>=2.3.0, <=3.0.2) +2394 more potentially affected by CVE-2026-27606 via rollup (>=2.0.0, <=2.79.2)

rollup NPM version =2.0.0, =2.3.0, =1.0.17, =1.0.0-canary.1, =0.0.74, =0.0.14, =1.0.0, =0.0.10, =0.0.3, =1.0.1, =1.0.12, =1.0.0, =0.0.4, =0.0.5 and more Source cves: CVE-2026-27606 Source advisory: SNYK:JS-ROLLUP-15340920...

@01.software/sdk (>=0.0.1-251008.90016, <=0.1.4), @adenta/cms (>=0.0.6, <=1.1.1-0) +28 more potentially affected by CVE-2026-27567 via payload (>=3.0.0-alpha.49, <=3.74.0-internal.097fb57)

payload NPM version =3.0.0-alpha.49, =0.0.1-251008.90016, =0.0.6, =0.0.3, =1.0.1-beta.0, =1.0.0, =0.1.0, =1.0.0, =3.1.0-types, =1.0.0, =3.64.0, =0.0.1-beta.0, =0.2.0, =0.2.14 - @remy90/payload-conditions-plugin 0.2.2 and more Source cves: CVE-2026-27567 Source advisory: OSV:GHSA-HHFX-5X8J-F5F6...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +8 more potentially affected by CVE-2026-25755 via jspdf (>=4.0.0, <=4.1.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves: CVE-2026-25755 Source advisory: OSV:GHSA-9VJF-QC39-JPRP...

Ghost has a SQL injection in Content API

Impact A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database. Vulnerable Versions This vulnerability is present in Ghost v3.24.0 to v6.19.0. Patches v6.19.1 contains a fix for this issue. Note: as this...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @machina.at/cli (>=19.24.1, <=19.43.0) +20 more potentially affected by CVE-2026-25724 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.76)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =1.9.1, =1.9.1, =1.9.6 and more Source cves: CVE-2026-25724 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-15248353...

@circleci/agents (2.13.2-canary.8150572), @tessl/cli (>=0.21.0, <=0.21.2) +9 more potentially affected by CVE-2026-24052 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.108)

@anthropic-ai/claude-code NPM version =1.0.8, =0.21.0, =0.2.0, =0.1.34, =1.8.0, =0.1.44, =0.0.22, =0.0.11, =0.0.27, =0.0.31 - locadex 0.0.2-alpha.1 Source cves: CVE-2026-24052 Source advisory: OSV:GHSA-VHW5-3G5M-8GGF...

@orval/angular (>=7.19.0, <=7.20.0), @orval/axios (>=7.19.0, <=7.20.0) +8 more potentially affected by CVE-2026-25141 via @orval/core (>=7.19.0, <=7.20.0)

@orval/core NPM version =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.19.0, =7.20.0 Source cves: CVE-2026-25141 Source advisory: OSV:GHSA-GCH2-PHQH-FG9Q...

3llm (0.0.1), @3bitmt/3bit-sidebar-dashboard (1.1.4) +266 more potentially affected by unknown CVE via next (>=15.1.1, <=15.1.11)

next NPM version =15.1.1, =0.0.4-alpha-20241218130538-b1235534784f95b3524711b50802add67747c676, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.1, =0.1.1, =0.1.0, =1.0.0, =1.0.6 - @axle-energy/components 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H25M-26QC-WCJF...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-qofeno/agentx-cli (>=1.20.47, <=1.20.52) +122 more potentially affected by CVE-2026-23957 via seroval (>=1.0.7, <=1.3.2)

seroval NPM version =1.0.7, =0.2.5, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =0.3.2 - @entropy-tamer/reynard-config 0.1.2 - @entropy-tamer/reynard-i18n 1.2.0 - @entropy-tamer/reynard-validation 0.2.0 and more Source cves: CVE-2026-23957 Source advisory:...

@01.software/sdk (>=0.0.1-251008.90016, <=0.1.0-dev.260109.7cf07c9), @adenta/cms (>=0.0.6, <=1.1.1-0) +356 more potentially affected by CVE-2026-22036 via undici (>=7.0.0, <=7.18.0)

undici NPM version =7.0.0, =0.0.1-251008.90016, =0.0.6, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =1.0.1-dev.120, =12.6.9, =1.6.3, =0.1.6, =0.13.70, =0.13.99 and more Source cves: CVE-2026-22036 Source advisory: SNYK:JS-UNDICI-14943963...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +40 more potentially affected by CVE-2026-22610 via @angular/compiler (>=19.0.0, <=19.2.17)

@angular/compiler NPM version =19.0.0, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.346.0, =0.0.1-canary.0.0, =1.0.0-canary.1 - @ismailadekambi/shared 1.0.0 and more Source cves: CVE-2026-22610 Source advisory:...

01-numacert (>=1.0.0, <=3.0.0), 12g (>=0.0.15, <=1.0.1) +7557 more potentially affected by CVE-2026-24001 via diff (>=3.0.0, <=3.5.0)

diff NPM version =3.0.0, =1.0.0, =0.0.15, =1.0.4, =5.4.4, =5.4.4, =2.2.1, =1.1.8, =1.0.0, =2.0.0, =0.0.1, =0.1.1, =0.1.0, =1.0.0, =1.8.1 and more Source cves: CVE-2026-24001 Source advisory: SNYK:JS-DIFF-14917201...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2008 more potentially affected by CVE-2026-0621 via @modelcontextprotocol/sdk (>=1.3.0, <=1.25.1)

@modelcontextprotocol/sdk NPM version =1.3.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =0.0.2, =1.0.0, =1.0.19 and more Source cves: CVE-2026-0621 Source advisory: OSV:GHSA-8R9Q-7V3J-JR4G...