@acabai/android (>=1.0.0, <=1.0.1), @addfox/cli (>=0.1.1-beta.2, <=0.1.1) +177 more potentially affected by CVE-2026-31988 via yauzl (3.2.0)

yauzl NPM version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on yauzl and may be impacted: - @acabai/android =1.0.0, =0.1.1-beta.2, =0.1.1-beta.2, =1.6.10, =3.4.26, =2.1.83, =1.2.7, =1.1.22, =8.0.0, =10.0.0, =10.0.0, =1.0.0, =1.0.1, =8.9.4,...

acril (0.1.0), acril-http (0.1.0) +911 more potentially affected by unknown CVE via http-types (>=1.3.1, <=2.12.0)

http-types CARGO version =1.3.1, =4.0.0, =0.1.0, =0.1.0, =0.3.0, =0.10.0, =0.3.0, =0.1.0, =0.1.0, =0.6.0, =0.0.1, =0.2.0, =0.7.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0174...

@aimo.network/svm (>=1.0.0, <=1.8.0), @andesmountain/x402-request (>=1.0.0, <=1.0.3) +9 more potentially affected by unknown CVE via @x402/svm (>=2.0.0, <=2.5.0)

@x402/svm NPM version =2.0.0, =1.0.0, =1.0.0, =0.1.0, =4.0.0, =0.12.7, =0.2.0, =0.2.3 Source cves: unknown CVE Source advisory: SNYK:JS-X402SVM-15440550...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +381 more potentially affected by CVE-2026-29045 via hono (>=4.0.0, <=4.12.3)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =0.0.19 and more Source cves: CVE-2026-29045 Source advisory: SNYK:JS-HONO-15419466...

4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1510 more potentially affected by CVE-2026-3520 via multer (>=2.0.0, <=2.1.0)

multer NPM version =2.0.0, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =0.6.2 and more Source cves: CVE-2026-3520 Source advisory: OSV:GHSA-5528-5VMV-3XC2...

GHSA-4GC7-QCVF-38WG In OpenClaw, manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program

Summary This issue applies to a non-default configuration only. If sort is manually added to tools.exec.safeBins, OpenClaw could treat sort --compress-program= as valid safe-bin usage. In security=allowlist + ask=on-miss, this could satisfy allowlist checks and skip operator approval, while GNU...

@activeboxes/piece-sftp (0.2.6), @activepieces/piece-apify (0.2.1) +24 more potentially affected by CVE-2026-27699 via basic-ftp (>=5.0.2, <=5.1.0)

basic-ftp NPM version =5.0.2, =0.2.6, =1.0.0, =1.0.0, =2.0.18, =1.9.2, =1.2.0, =4.6.0-blowfish, =1.0.3, =1.0.4, =0.1.1, =0.2.0 and more Source cves: CVE-2026-27699 Source advisory: SNYK:JS-BASICFTP-15366428...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @10xly/eslint-config (>=1.0.0, <=1.0.8) +1219 more potentially affected by CVE-2026-27903 via minimatch (>=10.0.0, <=10.2.2)

minimatch NPM version =10.0.0, =0.0.1, =1.0.0, =6.0.0-test.1, =10.0.0, =10.0.0, =8.0.1, =13.0.0, =5.1.3, =0.2.0, =0.9.2, =0.5.1-alpha.0, =4.10.0, =4.16.0 and more Source cves: CVE-2026-27903 Source advisory: OSV:GHSA-7R86-CG39-JMMJ...

@0x590fab/sdcor2 (>=4.2.1, <=4.4.0), @cenk1cenk2/renovate-config (>=2.2.33, <=2.3.94) +22 more potentially affected by CVE-2026-27904 via minimatch (>=6.0.0, <=6.2.0)

minimatch NPM version =6.0.0, =4.2.1, =2.2.33, =0.2.6-alpha-20230114225627-66f5d9eac, =0.1.7-alpha-20230114225627-66f5d9eac, =0.15.7-alpha-20230114225627-66f5d9eac, =0.1.0, =3.108.8--canary.1.4727068200.0, =0.0.0, =1.12.0, =1.0.0-beta.13, =0.36.6-0, =0.36.6-0, =0.39.3-0 - editorconfig 1.0.2 and...

@akash-aw/aw-wizard-forms (4.14.0), @alfresco/aca-generators (>=1.0.0, <=1.0.1) +137 more potentially affected by CVE-2026-27959 via koa (>=3.0.0, <=3.1.1)

koa NPM version =3.0.0, =1.0.0, =1.0.0, =0.44.0, =0.0.0-nightly-20260213031600, =0.0.0-nightly-20260317031259, =0.0.0-nightly-20260317031259, =0.0.0-nightly-20260213031600, =2025.12.1, =2.23.0, =0.0.1, =0.20.0, =0.0.5, =2026.1.2, =2.0.0, =2.0.1 and more Source cves: CVE-2026-27959 Source advisory...

@asherng/storybook (>=0.0.18, <=0.1.14), @bluefin-exchange/starship-v2 (>=1.1.1, <=1.1.16) +32 more potentially affected by CVE-2026-27148 via storybook (>=7.0.6, <=7.6.20)

storybook NPM version =7.0.6, =0.0.18, =1.1.1, =0.0.1, =0.0.4, =1.2.108, =3.50.0-next.2, =9.0.0-next.4, =1.0.967, =0.0.1, =1.0.0-beta.1, =1.2.2, =0.0.1, =0.0.1, =7.6.4-next.32, =6.0.0-canary.234, =6.0.0-canary.318 and more Source cves: CVE-2026-27148 Source advisory: SNYK:JS-STORYBOOK-15353401...

@cognigy/cognigy-cli (>=1.9.7, <=2.2.7), @forestadmin/agent (>=1.71.0, <=1.72.9) +29 more potentially affected by CVE-2026-27795 via @langchain/community (>=1.0.0, <=1.1.16)

@langchain/community NPM version =1.0.0, =1.9.7, =1.71.0, =1.1.0, =1.12.76, =0.0.1, =0.1.0, =0.2.0, =0.20.0, =0.21.0, =0.0.16, =1.4.13, =1.0.1, =1.0.24, =1.0.26 and more Source cves: CVE-2026-27795 Source advisory: OSV:GHSA-MPHV-75CG-56WG...

The Post-RAMP Era: Allegations, Fragmentation, and the Rebuilding of the Ransomware Underground

Executive summary The January 2026 seizure of RAMP disrupted a major ransomware coordination hub, but it did not dismantle the ecosystem behind it. Instead, it destabilized trust and accelerated fragmentation across the underground. Rather than consolidating around a single successor, ransomware...

Wordfence Bug Bounty Program Monthly Report – January 2026

Last month in January 2026, the Wordfence Bug Bounty Program received 897 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfenc...

CVE-2026-24790 Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller Missing Authentication for Critical Function

The underlying PLC of the device can be remotely influenced, without proper safeguards or authentication...

CVE-2026-24790 Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller Missing Authentication for Critical Function

The underlying PLC of the device can be remotely influenced, without proper safeguards or authentication...

CVE-2026-24790

Technical details about CVE-2026-24790 are not publicly available in the provided documents. Monitor for updates.

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +8 more potentially affected by CVE-2026-25755 via jspdf (>=4.0.0, <=4.1.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves: CVE-2026-25755 Source advisory: OSV:GHSA-9VJF-QC39-JPRP...

Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller

RISK EVALUATION Successful exploitation of this vulnerability could result in an over- or under-odorization event. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control...

@aadarshjr/reweb-js (>=1.0.7, <=1.0.17), @acentswap/ace-core-trial (>=10.4.0, <=10.7.0) +898 more potentially affected by CVE-2026-26996 via minimatch (>=5.0.0, <=5.1.6)

minimatch NPM version =5.0.0, =1.0.7, =10.4.0, =9.0.0, =10.0.0, =10.0.0, =10.5.0, =10.4.0, =0.4.13, =2.3.0, =2.3.0, =2.2.1, =2.2.1, =2.2.2 - @aid-on/aidify 0.1.2 and more Source cves: CVE-2026-26996 Source advisory: OSV:GHSA-3PPC-4F35-3M26...