flaskbb-plugin-atom (>=0.1.0, <=0.2.0), flaskbb-plugin-conversations (>=2.0.1, <=2.0.2) +6 more potentially affected by CVE-2026-22660 via flaskbb (2.2.0)

flaskbb PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on flaskbb and may be impacted: - flaskbb-plugin-atom =0.1.0, =2.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0 Source cves: CVE-2026-22660 Source advisory: SNYK:PYTHON-FLASKBB-17950951...

01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +18979 more potentially affected by CVE-2026-12590 via body-parser (>=1.0.0, <=1.20.5)

body-parser NPM version =1.0.0, =1.0.0, =0.2.0, =1.0.2, =2.0.0, =0.2.0, =0.0.978, =0.2.0, =0.0.1, =0.0.28, =0.0.36 and more Source cves: CVE-2026-12590 Source advisory: SNYK:JS-BODYPARSER-17906397...

EUVD-2026-42516

Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users to overwrite C:\bosh\servicewrapper.exe or C:\bosh\bosh-agent.exe and gain NT AUTHORITY\SYSTEM on the next service restart or reboot. This can lead to full...

CVE-2026-47830: Undefined Security Weakness

Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users to overwrite C:\bosh\servicewrapper.exe or C:\bosh\bosh-agent.exe and gain NT AUTHORITY\SYSTEM on the next service restart or reboot. This can lead to full...

@agentbadge/mcp (>=0.1.9, <=0.2.0), @agentbadge/passport (>=0.1.8, <=0.2.0) +120 more potentially affected by CVE-2026-59876 via protobufjs (>=8.2.0, <=8.6.4)

protobufjs NPM version =8.2.0, =0.1.9, =0.1.8, =0.1.1, =0.1.1, =1.16.0, =1.0.5, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.1.37, =0.1.29, =0.1.35 and more Source cves: CVE-2026-59876 Source advisory: SNYK:JS-PROTOBUFJS-17900554...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +921 more potentially affected by CVE-2026-59873 via tar (>=7.0.0, <=7.5.18)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59873 Source advisory: SNYK:JS-TAR-17909152...

@adobe/aem-cli (>=16.21.1, <=16.21.2), @adobe/helix-docx2md (>=1.9.29, <=1.9.30) +48 more potentially affected by CVE-2026-59870 via js-yaml (>=5.0.0, <=5.2.0)

js-yaml NPM version =5.0.0, =16.21.1, =1.9.29, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =1.0.8, =0.0.0-next-20260630092247, =0.0.0-next-20260630092247, =0.0.0-next-20260630092247, =0.0.0-next-20260824173136 and more Source cves: CVE-2026-59870 Source advisory: SNYK:JS-JSYAML-17900063...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +710 more potentially affected by CVE-2026-59897 via hono (>=4.3.6, <=4.12.26)

hono NPM version =4.3.6, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-59897 Source advisory: SNYK:JS-HONO-17900541...

@inkeep/agents-api (>=0.73.0, <=0.80.6), @inkeep/agents-cli (>=0.73.0, <=0.80.6) +5 more potentially affected by CVE-2026-53518 via @better-auth/oauth-provider (1.6.9)

@better-auth/oauth-provider NPM version 1.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on @better-auth/oauth-provider and may be impacted: - @inkeep/agents-api =0.73.0, =0.73.0, =0.73.1, =0.73.0, =0.73.1, =0.73.1, =0.73.1, =0.80.6 Source cves:...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +199 more potentially affected by CVE-2026-67336 via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-67336 Source advisory: OSV:GHSA-9H47-PQCX-HJR4...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +199 more potentially affected by CVE-2026-53514 via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-53514 Source advisory: SNYK:JS-BETTERAUTH-17889813...

@absinthe/graphql-playground (>=1.3.1, <=1.3.5), @absinthe/socket (>=0.1.0, <=0.2.0) +52 more potentially affected by CVE-2026-56812 via phoenix (>=1.3.0, <=1.5.12)

phoenix NPM version =1.3.0, =1.3.1, =0.1.0, =0.1.2, =0.1.0, =0.1.2, =1.7.5, =1.5.1, =1.7.5, =1.8.1, =1.0.0, =1.5.6, =1.8.1, =1.8.1, =1.7.26, =1.7.26, =1.16.6-beta-eaa4d39d and more Source cves: CVE-2026-56812 Source advisory: OSV:EEF-CVE-2026-56812...

-react-file-list-components (1.1.1), -tompan-reacttemplate (>=1.0.1, <=1.1.0) +41035 more potentially affected by CVE-2026-14802 via react-dev-utils (>=0.1.1, <=12.1.0-next.26)

react-dev-utils NPM version =0.1.1, =1.0.1, =0.1.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 - 0scarclassi 1.0.1 and more Source cves: CVE-2026-148...

Malicious code in fmt-date-lite (npm)

The npm package fmt-date-lite is a supply-chain dropper disguised as a benign date-formatting utility its description reads "Lightweight date formatting utility with locale support". It ships six files, no source repository and no dependencies, with its real behaviour in an install script. A...

@devpodio/github-extension (1.0.0), @eclipse-glsp-examples/workflow-theia (>=1.0.0-theia1.27.0, <=1.1.0-next.e29c96e.130) +119 more potentially affected by CVE-2026-10055 via @theia/request (>=1.26.0, <=1.72.3)

@theia/request NPM version =1.26.0, =1.0.0-theia1.27.0, =1.0.0, =0.7.1, =1.58.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.57.0-next.37, =1.46.0-next.241, =1.72.3 and more Source cves: CVE-2026-10055 Source advisory: SNYK:JS-THEIAREQUEST-17810719...

@falcondev-oss/nuxt-layers-base (>=0.1.0, <=0.25.0), @iqual/nuxt-icms (>=1.6.0-rc.1, <=1.6.1) +25 more potentially affected by unknown CVE via @nuxt/ui (>=4.0.0, <=4.8.0)

@nuxt/ui NPM version =4.0.0, =0.1.0, =1.6.0-rc.1, =1.1.6, =0.0.19, =0.5.0, =0.0.7, =0.0.0-test-ld-20260520212549, =0.0.0-test-ld-20260520212549, =0.9.0, =0.0.0-test-ld-20260520212549, =0.0.0-test-ld-20260520212549, =0.4.0, =0.4.0, =1.1.0, =1.0.1, =1.1.4 and more Source cves: unknown CVE Source...

@activepieces/piece-json (>=0.1.6, <=0.1.7), @bifravst/muninn-proto (>=5.0.0, <=5.2.0) +109 more potentially affected by CVE-2026-52746 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =5.0.0, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =3.3.0 and more Source cves: CVE-2026-52746 Source advisory: SNYK:JS-JSONATA-17810727...

@grackle-ai/cli (>=0.72.3, <=0.132.1), @grackle-ai/core (>=0.75.4, <=0.132.1) +7 more potentially affected by unknown CVE via @grackle-ai/auth (>=0.72.3, <=0.132.1)

@grackle-ai/auth NPM version =0.72.3, =0.72.3, =0.75.4, =0.72.3, =0.96.3, =0.99.0, =0.97.0, =0.98.0, =0.72.3, =0.75.1, =0.132.1 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIAUTH-17817919...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53839 via openclaw (>=2026.3.22, <=2026.5.6)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53839 Source advisory: OSV:GHSA-77Q5-RR5V-X43Q...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53807 via openclaw (>=2026.3.22, <=2026.5.2)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53807 Source advisory: OSV:GHSA-W5WW-7CHG-MXCQ...