@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @42zeroo/tescik (>=1.0.0, <=1.1.1963) +709 more potentially affected by CVE-2026-41242 via protobufjs (8.0.0)

protobufjs NPM version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobufjs and may be impacted: - @0xchain/telemetry =1.1.0-beta.8, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.6.0, =0.8.0 - @adaptic/backend-legacy 0.0.941 and more...

@activeboxes/piece-sftp (0.2.6), @activepieces/piece-apify (0.2.1) +26 more potentially affected by CVE-2026-41324 via basic-ftp (>=5.0.2, <=5.2.2)

basic-ftp NPM version =5.0.2, =0.2.6, =1.0.0, =1.0.0, =2.0.18, =1.9.2, =1.2.0, =4.6.0-blowfish, =1.0.3, =1.0.4, =1.0.5 - @neurarank/node-sftp 0.4.3 and more Source cves: CVE-2026-41324 Source advisory: OSV:GHSA-RP42-5VXX-QPWR...

3m (>=0.1.0, <=0.1.3), a2d-diary (>=0.1.0, <=0.1.5) +1795 more potentially affected by CVE-2026-41314 via pypdf2 (>=1.24.0, <=3.0.1)

pypdf2 PYPI version =1.24.0, =0.1.0, =0.1.0, =1.1.0, =0.1.32, =0.0.0.1, =0.0.1.44, =0.0.1, =0.2.2.716, =0.1.4, =1.0.3, =0.1.3, =0.2.0, =0.4.2 - adame 0.2.2 and more Source cves: CVE-2026-41314 Source advisory: SNYK:PYTHON-PYPDF2-16097900...

3m (>=0.1.0, <=0.1.3), a2d-diary (>=0.1.0, <=0.1.5) +1795 more potentially affected by CVE-2026-41313 via pypdf2 (>=1.24.0, <=3.0.1)

pypdf2 PYPI version =1.24.0, =0.1.0, =0.1.0, =1.1.0, =0.1.32, =0.0.0.1, =0.0.1.44, =0.0.1, =0.2.2.716, =0.1.4, =1.0.3, =0.1.3, =0.2.0, =0.4.2 - adame 0.2.2 and more Source cves: CVE-2026-41313 Source advisory: SNYK:PYTHON-PYPDF2-16097904...

a11ywatch_cli (>=0.0.26, <=0.7.16), aap (>=0.4.0, <=0.4.1) +3743 more potentially affected by unknown CVE via rustls-webpki (>=0.101.7, <=0.102.8)

rustls-webpki CARGO version =0.101.7, =0.0.26, =0.4.0, =0.1.0, =0.21.0-alpha.1, =0.1.11, =0.12.1, =0.2.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-965H-392X-2MH5...

@appwise/oauth2-server (>=0.0.19, <=0.2.2), @dyne/slangroom-chain (>=1.4.0, <=1.16.10) +4 more potentially affected by CVE-2026-41213 via @node-oauth/oauth2-server (>=5.0.0, <=5.2.1)

@node-oauth/oauth2-server NPM version =5.0.0, =0.0.19, =1.4.0, =1.3.0, =1.49.1, =1.0.0, =1.0.0, =1.0.1 Source cves: CVE-2026-41213 Source advisory: SNYK:JS-NODEOAUTHOAUTH2SERVER-16420261...

@13w/local-rag (>=1.6.0, <=1.7.2), @24letters/devservers (>=0.1.0, <=0.6.0) +750 more potentially affected by CVE-2026-6410 via @fastify/static (>=8.0.0, <=9.1.0)

@fastify/static NPM version =8.0.0, =1.6.0, =0.1.0, =0.1.0, =0.4.0, =0.1.0-rc.1, =0.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =1.0.0-beta.23, =1.0.3 and more Source cves: CVE-2026-6410 Source advisory: SNYK:JS-FASTIFYSTATIC-16098211...

@secustor/backstage-plugin-renovate-backend-module-runtime-direct (4.0.1) potentially affected by CVE-2026-76226 via renovate (43.77.2)

renovate NPM version 43.77.2 is affected by a known vulnerability. The following packages have a transitive dependency on renovate and may be impacted: - @secustor/backstage-plugin-renovate-backend-module-runtime-direct 4.0.1 Source cves: CVE-2026-76226 Source advisory: OSV:GHSA-5VJQ-5JMG-39XQ...

@amedia/brick-mcp (>=0.0.0-vBRAND-20260313141110, <=1.0.3), @area15/ticket-component (0.1.0) +230 more potentially affected by CVE-2025-32442 +1 more via fastify (>=5.3.2, <=5.8.4)

fastify NPM version =5.3.2, =0.0.0-vBRAND-20260313141110, =2.0.1, =1.1.1, =0.6.2, =0.1.1, =0.1.1, =0.6.0, =0.1.1, =0.0.35, =0.0.82, =0.0.1, =0.0.6, =0.1.68, =0.1.0, =0.8.2 and more Source cves: CVE-2025-32442, CVE-2026-33806 Source advisory: OSV:GHSA-247C-9743-5963...

@grupo-loja/vendure-banner-plugin (1.0.0), @grupo-loja/vendure-conect-envios-plugin (>=1.0.0, <=1.0.1) +54 more potentially affected by CVE-2026-40887 via @vendure/core (>=1.9.5, <=2.2.7)

@vendure/core NPM version =1.9.5, =1.0.0, =0.0.1, =1.0.3, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.2.4 and more Source cves: CVE-2026-40887 Source advisory: SNYK:JS-VENDURECORE-16068909...

-lidonghui (1.0.0), -test-bitbucket-branch-manager (1.0.1) +60210 more potentially affected by CVE-2026-40895 via follow-redirects (>=1.0.0, <=1.15.11)

follow-redirects NPM version =1.0.0, =1.0.1, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.1 - 03-asenkronsdasdsadavehttprequest 1.0.0 - 04-17 1.0.0 - 04-17zy 1.0.0 - 04-a 1.0.0 and more Source cves: CVE-2026-40895 Source advisory: SNYK:JS-FOLLOWREDIRECTS-16032162...

@artur-abliazimov/othentic-cli (1.16.6), @darraghor/nest-backend-libs (>=3.8.8, <=5.0.11) +21 more potentially affected by CVE-2026-40879 via @nestjs/microservices (>=11.0.1, <=11.1.18)

@nestjs/microservices NPM version =11.0.1, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.0.0, =1.9.1, =1.16.9 and more Source cves: CVE-2026-40879 Source advisory: SNYK:JS-NESTJSMICROSERVICES-16082546...

3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +606 more potentially affected by CVE-2026-28291 via simple-git (>=3.0.3, <=3.31.1)

simple-git NPM version =3.0.3, =1.0.1, =1.0.1, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =23.0.0, =35.0.0, =1.4.0, =0.1.5-alpha.0, =1.0.2, =8.7.2, =39.0.2, =39.0.3 and more Source cves: CVE-2026-28291 Source advisory: OSV:GHSA-JCXM-M3JX-F287...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +14723 more potentially affected by CVE-2026-40175 via axios (>=1.0.0, <=1.14.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-40175 Source advisory: SNYK:JS-AXIOS-15969258...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +14723 more potentially affected by CVE-2026-40175 via axios (>=1.0.0, <=1.14.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-40175 Source advisory: OSV:GHSA-FVCV-3M26-PCQX...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.4), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0, <=1.5.4)

@saltcorn/server NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.4 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

@alexaegis/svelte-config (>=0.9.2, <=0.15.0), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +17 more potentially affected by CVE-2026-40074 via @sveltejs/kit (>=2.0.0, <=2.55.0)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =10.0.1, =0.1.0, =0.0.1-alpha.26, =0.4.1, =5.0.0-alpha.1, =0.0.1, =1.0.1-next.0, =0.0.10, =1.0.54 and more Source cves: CVE-2026-40074 Source advisory: SNYK:JS-SVELTEJSKIT-15967888...

@alexaegis/svelte-config (>=0.9.2, <=0.15.0), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +17 more potentially affected by CVE-2026-40073 via @sveltejs/kit (>=2.0.0, <=2.55.0)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =10.0.1, =0.1.0, =0.0.1-alpha.26, =0.4.1, =5.0.0-alpha.1, =0.0.1, =1.0.1-next.0, =0.0.10, =1.0.54 and more Source cves: CVE-2026-40073 Source advisory: SNYK:JS-SVELTEJSKIT-15967891...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (0.8.3-beta.1) +11 more potentially affected by CVE-2026-35617 via openclaw (>=2026.3.22, <=2026.3.24-beta.2)

openclaw NPM version =2026.3.22, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-35617 Source advisory: SNYK:JS-OPENCLAW-15967186...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +18 more potentially affected by CVE-2026-41915 via openclaw (>=2026.3.22, <=2026.4.5)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =4.2.0 - openclaw-chatclaw 0.1.0 and more Source cves: CVE-2026-41915 Source advisory: OSV:GHSA-CM8V-2VH9-CXF3...