@brikcss/rollup-config-generator (>=0.0.15, <=0.0.16), @brikcss/stakcss (>=0.0.0, <=0.9.1) +9 more potentially affected by CVE-2026-6594 via @brikcss/merge (>=1.0.7, <=1.3.0)

@brikcss/merge NPM version =1.0.7, =0.0.15, =0.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.1, =0.2.0, =0.10.0 Source cves: CVE-2026-6594 Source advisory: OSV:GHSA-3JC6-6R48-V6QF...

011xwztpjn (1.0.0), 02y9dg4qm3 (1.0.0) +11501 more potentially affected by CVE-2026-41239 via dompurify (>=1.0.10, <=3.3.3)

dompurify NPM version =1.0.10, =3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on dompurify and may be impacted: - 011xwztpjn 1.0.0 - 02y9dg4qm3 1.0.0 - 04tw75kmd9 1.0.0 - 0650teqqly 1.0.0 - 097oi25ils 1.0.0 - 0a0fpniotn 1.0.0 - 0c7j76u46q 1.0.0 -...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2123 more potentially affected by CVE-2026-41238 via dompurify (>=3.0.1, <=3.3.3)

dompurify NPM version =3.0.1, =0.3.96, =0.5.12, =0.3.33, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =0.2.10 and more Source cves: CVE-2026-41238 Source advisory: SNYK:JS-DOMPURIFY-16132234...

MAL-2026-2863 Malicious code in rblx-studio-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0984290664d514183109c836bea6a2bda03e33f89563accc6c79a51e281688f8 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

Malicious code in robase-setup (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3fcd831a04f3c23efde7a365717e715cec5c6fb5211d26e5d76ace539abb06bc During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

MAL-2026-2864 Malicious code in robase-setup (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3fcd831a04f3c23efde7a365717e715cec5c6fb5211d26e5d76ace539abb06bc During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

Original Sin of Npm: A Study on Vulnerability Propagation in JavaScript Dependency Networks

Understanding vulnerability propagation is essential for assessing how vulnerabilities spread across components of a software package. This supports more accurate impact analysis and enhances threat detection and mitigation. In this paper, we investigate how a small number of vulnerable JavaScrip...

Fedora 42 : incus (2026-4481307278)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4481307278 advisory. Remove incus dependency from incus-agent. ---- Update to 6.23 Tenable has extracted the preceding description block directly from the Fedora securit...

@0xpolygonid/js-sdk (>=1.32.1, <=1.34.0), @142vip/common (>=0.0.1-alpha.9, <=0.0.1-alpha.14) +2854 more potentially affected by CVE-2026-41907 via uuid (>=11.0.0, <=11.1.0)

uuid NPM version =11.0.0, =1.32.1, =0.0.1-alpha.9, =0.0.3-alpha.1, =0.1.6-alpha.9, =0.0.1-alpha.0, =1.0.0-alpha.20, =2.16.1, =1.0.0-alpha.34, =0.1.0-alpha.1, =1.0.0, =0.24.1-20230627140514, =0.25.1-20250326172337, =0.24.1-20230627140514, =0.24.1-20231019080841 and more Source cves: CVE-2026-41907...

1router (>=0.3.96, <=1.0.2), 3d-bin-packing-ts (>=1.0.0, <=1.0.1) +7654 more potentially affected by CVE-2026-41907 via uuid (>=12.0.0, <=13.0.2)

uuid NPM version =12.0.0, =0.3.96, =1.0.0, =2.1.0, =0.3.33, =0.5.0, =0.4.71, =0.0.1, =0.3.0, =0.4.0, =0.2.0, =0.0.6, =0.0.8-rc.1 and more Source cves: CVE-2026-41907 Source advisory: SNYK:JS-UUID-16133035...

MAL-2026-2859 Malicious code in rblx-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 be690c2f32ad941003f8733406643848380c3918af421fa56c8ec0802b9c261d During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

@nocobase/acl (>=2.0.0-alpha.2, <=2.0.6), @nocobase/actions (>=2.0.0-alpha.2, <=2.0.36) +11 more potentially affected by CVE-2026-40346 via @nocobase/utils (>=2.0.0, <=2.0.36)

@nocobase/utils NPM version =2.0.0, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.0-alpha.2, =2.0.36 Source cves: CVE-2026-40346 Source advisory:...

@smg-automotive/auth (>=8.2.3, <=9.0.2-support-next-16.2.1) potentially affected by CVE-2026-40155 via @auth0/nextjs-auth0 (>=4.12.1, <=4.17.1)

@auth0/nextjs-auth0 NPM version =4.12.1, =8.2.3, =9.0.2-support-next-16.2.1 Source cves: CVE-2026-40155 Source advisory: SNYK:JS-AUTH0NEXTJSAUTH0-16109571...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-44111 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-44111 Source advisory: OSV:GHSA-F934-5RQF-XX47...

@chrysb/alphaclaw (>=0.8.8, <=0.9.5), @twsxtd/hapi-openclaw (>=0.1.0, <=0.1.8) +2 more potentially affected by CVE-2026-41389 via openclaw (>=2026.4.9, <=2026.4.12)

openclaw NPM version =2026.4.9, =0.8.8, =0.1.0, =0.1.8 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-41389 Source advisory: SNYK:JS-OPENCLAW-16109680...

@chrysb/alphaclaw (>=0.8.8, <=0.9.5), @twsxtd/hapi-openclaw (>=0.1.0, <=0.1.8) +2 more potentially affected by CVE-2026-41389 via openclaw (>=2026.4.9, <=2026.4.12)

openclaw NPM version =2026.4.9, =0.8.8, =0.1.0, =0.1.8 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-41389 Source advisory: OSV:GHSA-MR34-9552-QR95...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-44109 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-44109 Source advisory: OSV:GHSA-XH72-V6V9-MWHC...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-43585 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-43585 Source advisory: OSV:GHSA-XMXX-7P24-H892...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-43585 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-43585 Source advisory: SNYK:JS-OPENCLAW-16109684...

org.webjars.npm:built-in-math-eval (0.3.0), org.webjars.npm:interval-arithmetic-eval (0.4.6) potentially affected by CVE-2026-41507 via org.webjars.npm:math-codegen (0.3.5)

org.webjars.npm:math-codegen MAVEN version 0.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:math-codegen and may be impacted: - org.webjars.npm:built-in-math-eval 0.3.0 - org.webjars.npm:interval-arithmetic-eval 0.4.6 Source cves:...