-fides-amor-et-lux (=1.0.0), 1ib (>=1.0.9 <=1.0.11) +1133 more potentially affected by CVE-2026-33891 via node-forge (>=1.0.0 <=1.3.3)

node-forge NPM version =1.0.0, =1.0.9, =1.0.0, =7.10.2-para-beta.0, =1.3.0-patch.0, =0.0.1-custom-install-dir, =1.2.1, =1.0.0, =1.0.0, =1.2.6, =1.23.2, =1.35.0 - @arextest/arex-request-runtime =7.36.3 and more Source cves: CVE-2026-33891 Source advisory: SNYK:JS-NODEFORGE-15789769...

-fides-amor-et-lux (=1.0.0), -tompan-reacttemplate (>=1.0.1 <=1.1.0) +41756 more potentially affected by CVE-2026-33891 via node-forge (>=0.10.0 <=1.3.3)

node-forge NPM version =0.10.0, =1.0.1, =1.1.0 - 00ld8nuivn =2.1.0 - 00rqiw31nd =2.1.0 - 01dk01majk =2.1.0 - 02rjq8i863 =1.1.0 - 02vx8qsp01 =2.1.0 - 05y6tjgmws =1.1.0 - 066m7q8o0z =2.1.0 - 06buj9h3su =2.1.0 - 06dre15t8r =2.1.0 - 0726react =0.1.1 - 07fgapmu9l =1.1.0 - 07t2xvu6t4 =2.1.0 - 0850u4lkp...

@2ly/runtime (>=0.0.3 <=0.2.5), @aa.tamura/lib-gqf (>=0.0.1 <=0.0.5) +552 more potentially affected by unknown CVE via @apollo/server (>=4.10.0 <=5.4.0)

@apollo/server NPM version =4.10.0, =0.0.3, =0.0.1, =0.0.0, =0.0.9, =1.0.6, =0.0.29, =0.0.4, =0.0.4, =0.0.29, =0.0.32, =1.1.1, =4.1.0, =0.0.0, =0.0.1, =1.4.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-9Q82-XGWF-VJ6H...

2mxdev-gql-gateway (=1.0.0), 4m-node-server (>=0.0.1 <=0.0.8) +3158 more potentially affected by unknown CVE via apollo-server-core (>=1.3.2 <=3.9.0)

apollo-server-core NPM version =1.3.2, =0.0.1, =1.0.2, =0.0.80, =3.10.1, =1.2.0-pre.24, =1.0.1, =1.0.0, =1.0.0, =0.5.0, =1.0.0, =0.1.3, =0.0.1, =0.1.1, =0.0.1, =0.0.5 and more Source cves: unknown CVE Source advisory: SNYK:JS-APOLLOSERVERCORE-15790567...

@apollo/server-integration-testsuite (>=5.0.0 <=5.4.0), @commitspark/graphql-api (>=1.0.0-beta.3 <=1.0.0-beta.6) +24 more potentially affected by unknown CVE via @apollo/server (>=5.0.0-rc.0 <=5.4.0)

@apollo/server NPM version =5.0.0-rc.0, =5.0.0, =1.0.0-beta.3, =1.217.0, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.20.2, =2.22.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-APOLLOSERVER-15790568...

@agentholdings/agent-passport (=0.1.0), @flomesh/ztm-chat (>=2026.3.25 <=2026.3.26) +9 more potentially affected by CVE-2026-35632 via openclaw (>=2026.3.22 <=2026.3.23)

openclaw NPM version =2026.3.22, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-35632 Source advisory: SNYK:JS-OPENCLAW-15797933...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0 <=0.7.0), com.charlyghislain.keycloak:keycloak-importexport (>=21.0.0 <=23.0.1) +160 more potentially affected by CVE-2026-3121 via org.keycloak:keycloak-services (>=1.0-alpha-1 <=26.5.5)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =21.0.0, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.0.0, =1.2.0 and more Source cves: CVE-2026-3121 Source advisory: OSV:GHSA-7XF9-4JFC-WGM4https://vulners.com/osv/OSV:GHSA-7XF9-4JFC-...

org.webjars.npm:chai-backbone (=0.9.2), org.webjars.npm:express (=5.1.0) +5 more potentially affected by CVE-2026-4923 via org.webjars.npm:path-to-regexp (=8.2.0)

org.webjars.npm:path-to-regexp MAVEN version =8.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:path-to-regexp and may be impacted: - org.webjars.npm:chai-backbone =0.9.2 - org.webjars.npm:express =5.1.0 -...

@agentholdings/agent-passport (=0.1.0), @themw123/opencode-copilot-account-switcher (>=0.14.39 <=0.14.42) +5 more potentially affected by CVE-2026-35643 via openclaw (>=2026.3.22 <=2026.3.23-1)

openclaw NPM version =2026.3.22, =0.14.39, =0.1.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-35643 Source advisory: SNYK:JS-OPENCLAW-15789466...

@agentholdings/agent-passport (=0.1.0), @themw123/opencode-copilot-account-switcher (>=0.14.39 <=0.14.42) +5 more potentially affected by CVE-2026-35660 via openclaw (>=2026.3.22 <=2026.3.23-1)

openclaw NPM version =2026.3.22, =0.14.39, =0.1.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-35660 Source advisory: SNYK:JS-OPENCLAW-15789460...

@agentholdings/agent-passport (=0.1.0), @flomesh/ztm-chat (>=2026.3.25 <=2026.3.26) +8 more potentially affected by CVE-2026-35660 via openclaw (>=0.0.1 <=2026.3.23-2)

openclaw NPM version =0.0.1, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =0.0.7, =0.14.6, =0.1.0, =3.3.2, =3.3.7 Source cves: CVE-2026-35660 Source advisory: OSV:GHSA-WQ58-2PVG-5H4F...

@agentholdings/agent-passport (=0.1.0), @themw123/opencode-copilot-account-switcher (>=0.14.39 <=0.14.42) +5 more potentially affected by CVE-2026-35634 via openclaw (>=2026.3.22 <=2026.3.23-1)

openclaw NPM version =2026.3.22, =0.14.39, =0.1.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-35634 Source advisory: SNYK:JS-OPENCLAW-15789461...

@agentholdings/agent-passport (=0.1.0), @flomesh/ztm-chat (>=2026.3.25 <=2026.3.26) +8 more potentially affected by CVE-2026-35634 via openclaw (>=0.0.1 <=2026.3.23-2)

openclaw NPM version =0.0.1, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =0.0.7, =0.14.6, =0.1.0, =3.3.2, =3.3.7 Source cves: CVE-2026-35634 Source advisory: OSV:GHSA-6MQC-JQH6-X8FC...

@agentholdings/agent-passport (=0.1.0), @flomesh/ztm-chat (>=2026.3.25 <=2026.3.26) +8 more potentially affected by CVE-2026-35618 via openclaw (>=0.0.1 <=2026.3.23-2)

openclaw NPM version =0.0.1, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =0.0.7, =0.14.6, =0.1.0, =3.3.2, =3.3.7 Source cves: CVE-2026-35618 Source advisory: OSV:GHSA-CG6C-Q2HX-69H7...

at.aimit.mariella:persistence-kotlin (>=1.0.5 <=1.0.8), cloud.piranha.http:piranha-http-netty (>=25.4.0 <=25.5.0) +281 more potentially affected by CVE-2026-33871 via io.netty:netty-codec-http2 (>=4.2.0.Alpha1 <=4.2.0.RC4)

io.netty:netty-codec-http2 MAVEN version =4.2.0.Alpha1, =1.0.5, =25.4.0, =25.4.0, =7.9.0, =0.2.2, =0.2.4 - com.hexagontk.http:httpservernetty =4.1.1 - com.hexagontk.http:httpservernettyepoll =4.1.1 - com.inqwise:inqwise-context =1.0.0 - com.inqwise:inqwise-neo4j-client =1.0.0 and more Source cves...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.2 <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +19755 more potentially affected by CVE-2026-33871 via io.netty:netty-codec-http2 (>=4.1.0.Beta4 <=4.1.131.Final)

io.netty:netty-codec-http2 MAVEN version =4.1.0.Beta4, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.28.0 and more Source cves:...

ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +2093 more potentially affected by CVE-2026-33870 via io.netty:netty-codec-http (>=4.2.0.Alpha1 <=4.2.11.Final)

io.netty:netty-codec-http MAVEN version =4.2.0.Alpha1, =0.1.0, =0.1.0, =0.3.0 - ai.tock:bot-test =26.3.0 - ai.tock:bot-test-base =26.3.0 - ai.tock:bot-toolkit =26.3.0 - ai.tock:bot-toolkit-base =26.3.0 - ai.tock:tock-analytics-chatbase =26.3.0 - ai.tock:tock-aws-tools =26.3.0 -...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.2 <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +23656 more potentially affected by CVE-2026-33870 via io.netty:netty-codec-http (>=4.0.0.Alpha1 <=4.1.131.Final)

io.netty:netty-codec-http MAVEN version =4.0.0.Alpha1, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.28.0 and more Source cves:...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.2 <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +23656 more potentially affected by CVE-2026-33870 via io.netty:netty-codec-http (>=4.0.0.Alpha1 <=4.1.131.Final)

io.netty:netty-codec-http MAVEN version =4.0.0.Alpha1, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.28.0 and more Source cves:...

@antonyfaris/prefix-node-builtins (>=1.0.0 <=1.0.1), @anyauth/design-system (>=0.5.0 <=0.5.1) +354 more potentially affected by CVE-2026-33769 via astro (>=2.10.12 <=5.18.0)

astro NPM version =2.10.12, =1.0.0, =0.5.0, =1.0.0, =0.0.17, =0.0.2, =0.2.0, =0.0.0-experimental-7c2f356, =0.0.0-experimental-7c2f356, =0.0.1, =0.0.1, =0.0.1, =0.3.3 and more Source cves: CVE-2026-33769 Source advisory: OSV:GHSA-G735-7G2W-HH3F...