3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +639 more potentially affected by CVE-2026-6951 via simple-git (>=3.0.3, <=3.35.2)

simple-git NPM version =3.0.3, =1.0.1, =1.0.1, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =23.0.0, =35.0.0, =1.4.0, =0.1.5-alpha.0, =1.0.2, =0.0.0-aj-beta.221, =8.7.2, =8.11.4 and more Source cves: CVE-2026-6951 Source advisory: OSV:GHSA-HFFM-XVC3-VPRC...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16022 more potentially affected by CVE-2026-42040 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42040 Source advisory: SNYK:JS-AXIOS-16298055...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16022 more potentially affected by CVE-2026-42034 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42034 Source advisory: SNYK:JS-AXIOS-16298130...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16085 more potentially affected by CVE-2026-42044 via axios (>=1.0.0, <=1.15.1)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42044 Source advisory: SNYK:JS-AXIOS-16299921...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +14903 more potentially affected by CVE-2026-42037 via axios (>=1.3.0, <=1.15.0)

axios NPM version =1.3.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.0, =2.0.200 and more Source cves: CVE-2026-42037 Source advisory: SNYK:JS-AXIOS-16299819...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +156 more potentially affected by CVE-2026-41311 via liquidjs (>=10.2.0, <=10.25.5)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.8.0, =12.0.0, =1.0.1-beta.0, =1.6.3, =3.11.0-rc.0, =3.11.0-rc.0, =3.11.0-rc.0, =3.20.0-rc1 and more Source cves: CVE-2026-41311 Source advisory: SNYK:JS-LIQUIDJS-16205829...

lemmy_api (>=0.11.3-rc.5, <=0.18.0), lemmy_api_crud (>=0.11.3-rc.5, <=0.18.0) +5 more potentially affected by CVE-2026-42181 via lemmy_api_common (>=0.11.3-rc.5, <=0.18.0-rc.8)

lemmyapicommon CARGO version =0.11.3-rc.5, =0.11.3-rc.5, =0.11.3-rc.5, =0.11.3-rc.5, =0.11.3-rc.5, =0.11.3-rc.5, =0.11.3-rc.5, =0.11.3-rc.5, =0.16.7 Source cves: CVE-2026-42181 Source advisory: OSV:GHSA-H6HF-9846-XWRQ...

armature-diesel (0.1.0), aruna_policy (>=0.1.0, <=0.1.2) +112 more potentially affected by unknown CVE via diesel (>=2.0.0, <=2.3.4)

diesel CARGO version =2.0.0, =0.1.0, =0.1.0, =0.6.0, =0.1.0, =0.1.0, =0.0.6, =0.1.1, =0.1.5, =0.1.0, =0.1.2, =0.1.6 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0135...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-41909 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-41909 Source advisory: SNYK:JS-OPENCLAW-16206119...

5w-logger (1.0.0), @0xpolygonid/js-kms-key-provider-lit-protocol (>=1.0.0, <=1.0.4) +737 more potentially affected by CVE-2026-41907 +1 more via uuid (13.0.0)

uuid NPM version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on uuid and may be impacted: - 5w-logger 1.0.0 - @0xpolygonid/js-kms-key-provider-lit-protocol =1.0.0, =1.35.0, =10.0.0, =10.0.0, =8.1.0, =13.0.0, =4.0.0, =2.0.26,...

nimiq-account (0.1.0), nimiq-accounts (0.1.0) +14 more potentially affected by CVE-2026-34068 via nimiq-transaction (0.1.0)

nimiq-transaction CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on nimiq-transaction and may be impacted: - nimiq-account 0.1.0 - nimiq-accounts 0.1.0 - nimiq-block 0.1.0 - nimiq-block-production 0.1.0 - nimiq-blockchain 0.1.0 -...

nimiq-account (0.1.0), nimiq-accounts (0.1.0) +14 more potentially affected by CVE-2026-34067 via nimiq-transaction (0.1.0)

nimiq-transaction CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on nimiq-transaction and may be impacted: - nimiq-account 0.1.0 - nimiq-accounts 0.1.0 - nimiq-block 0.1.0 - nimiq-block-production 0.1.0 - nimiq-blockchain 0.1.0 -...

nimiq-accounts (0.1.0), nimiq-block (0.1.0) +13 more potentially affected by CVE-2026-34064 via nimiq-account (0.1.0)

nimiq-account CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on nimiq-account and may be impacted: - nimiq-accounts 0.1.0 - nimiq-block 0.1.0 - nimiq-block-production 0.1.0 - nimiq-blockchain 0.1.0 - nimiq-client 0.1.0 - nimiq-consens...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.3), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.3) potentially affected by unknown CVE via @saltcorn/server (>=1.0.0, <=1.4.3)

@saltcorn/server NPM version =1.0.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-16318352...

libcrux-digest (>=0.0.4-pre.1, <=0.0.8), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +10 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2, <=0.0.9-rc.1)

libcrux-sha3 CARGO version =0.0.2, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =1.20.4, =0.2.0, =0.4.3, =0.8.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0207...

@acampkin/mcc (>=2.1.0, <=2.5.0), @kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.6.0) +24 more potentially affected by CVE-2026-39861 via @anthropic-ai/claude-code (>=2.0.0, <=2.1.63)

@anthropic-ai/claude-code NPM version =2.0.0, =2.1.0, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.0.1, =0.4.0, =1.0.29, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =2.0.0 - ch-go 1.0.3 and more Source cves: CVE-2026-39861 Source advisory: OSV:GHSA-VP62-R36R-9XQP...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41301 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41301 Source advisory: SNYK:JS-OPENCLAW-16115371...

MAL-2026-2946 Malicious code in moonbit-metrics-validator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e6bb44c25db578131ec69b1c961c22f67cabb0b81aae5fe9d4620194bf8d83cc Campaign includes a chain of dependencies that finally exfiltrate sensitive environment variables to a hardcoded GitHub repository as exfiltration target, and ...

agentverse (0.1.8.1), airoboros (2.1.1) +34 more potentially affected by CVE-2026-6607 via fschat (>=0.2.2, <=0.2.36)

fschat PYPI version =0.2.2, =0.3.0, =0.0.1, =1.1.0, =1.1.0, =0.1.1, =0.1.1, =0.9.0.8, =1.0.0, =1.1.4 and more Source cves: CVE-2026-6607 Source advisory: SNYK:PYTHON-FSCHAT-16301528...

adclaw (>=1.0.0, <=1.0.33), agentjet (0.0.1) +45 more potentially affected by CVE-2026-6606 via agentscope (>=0.1.0, <=2.0.6)

agentscope PYPI version =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.2.0, =0.1.5, =1.0.0.post2, =0.1.0b1, =0.1.0, =0.0.1, =0.1.0, =0.2.0 and more Source cves: CVE-2026-6606 Source advisory: SNYK:PYTHON-AGENTSCOPE-16318346...