@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41365 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41365 Source advisory: SNYK:JS-OPENCLAW-15903320...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41336 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41336 Source advisory: SNYK:JS-OPENCLAW-15899233...

Security Bulletin: IBM i is Affected by Use of Hard-coded Cryptographic Key, Cross-site Scripting, and Prototype Pollution Vulnerabilities in IBM WebSphere Application Server Liberty [CVE-2025-14923, CVE-2025-12635, CVE-2026-29063]

Summary IBM WebSphere Application Server Liberty for IBM i is vulnerable to providing weaker than expected security CVE-2025-14923, improper validation of user-supplied input CVE-2025-12635, and improperly controlled modification of object prototype attributes in the Immutable package...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +5671 more potentially affected by CVE-2021-23337 +1 more via lodash-es (>=4.0.0, <=4.17.23)

lodash-es NPM version =4.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1-alpha.23, =1.0.0, =1.0.0, =2.14.1, =41.3.1, =2.1.0, =0.3.4, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.4.1 and more Source cves: CVE-2021-23337, CVE-2026-4800 Source advisory: OSV:GHSA-R5FR-RJXR-66JC...

EUVD-2026-17610

lodash vulnerable to Code Injection via .template imports key names...

-fides-amor-et-lux (1.0.0), -graphql-codegen-client-preset-swc-test (>=2.0.1, <=2.0.2) +50548 more potentially affected by CVE-2021-23337 +1 more via lodash (>=4.0.0, <=4.17.23)

lodash NPM version =4.0.0, =2.0.1, =1.0.49, =0.0.8, =0.2.0, =0.0.1, =1.0.0, =0.0.1, =2.3.0, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2021-23337, CVE-2026-4800 Source advisory: OSV:GHSA-R5FR-RJXR-66JC...

@dojo/cli-test-intern (>=0.1.0, <=2.0.0-beta3.1), express_mvc (>=4.1.1, <=4.3.10) +7 more potentially affected by CVE-2021-23337 +1 more via lodash-amd (>=4.16.4, <=4.17.23)

lodash-amd NPM version =4.16.4, =0.1.0, =4.1.1, =3.4.0, =0.0.1, =1.0.14, =0.0.7, =0.0.1, =0.1.5 - xirtam--matrix-operations 0.1.3 Source cves: CVE-2021-23337, CVE-2026-4800 Source advisory: OSV:GHSA-R5FR-RJXR-66JC...

09-nodejs (1.0.0), 11.17r (1.0.0) +561 more potentially affected by CVE-2021-23337 +1 more via lodash.template (>=4.0.0, <=4.5.0)

lodash.template NPM version =4.0.0, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =0.1.0, =1.0.0, =1.0.1, =1.0.1-0.beta.1, =1.0.0-beta.1, =1.1.5 - @arezooq/webserverpackage 1.0.0 and more Source cves: CVE-2021-23337, CVE-2026-4800 Source advisory: OSV:GHSA-R5FR-RJXR-66JC...

-fides-amor-et-lux (1.0.0), -graphql-codegen-client-preset-swc-test (>=2.0.1, <=2.0.2) +50548 more potentially affected by CVE-2025-13465 +1 more via lodash (>=4.0.0, <=4.17.23)

lodash NPM version =4.0.0, =2.0.1, =1.0.49, =0.0.8, =0.2.0, =0.0.1, =1.0.0, =0.0.1, =2.3.0, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2025-13465, CVE-2026-2950 Source advisory: OSV:GHSA-F23M-R3PF-42RH...

@akashic/akashic-cli (>=2.16.49, <=2.17.21), @akashic/akashic-cli-export (>=1.8.28, <=1.9.17) +253 more potentially affected by CVE-2025-13465 +1 more via lodash.unset (>=4.0.2, <=4.5.2)

lodash.unset NPM version =4.0.2, =2.16.49, =1.8.28, =1.2.1, =1.8.4, =8.0.0, =1.0.75, =0.0.2, =0.1.0, =1.31.9, =0.0.4, =0.6.0 and more Source cves: CVE-2025-13465, CVE-2026-2950 Source advisory: OSV:GHSA-F23M-R3PF-42RH...

GHSA-F23M-R3PF-42RH lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

Impact Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the .unset and .omit functions. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties fro...

EUVD-2026-17591

lodash vulnerable to Prototype Pollution via array path bypass in .unset and .omit...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +5671 more potentially affected by CVE-2025-13465 +1 more via lodash-es (>=4.0.0, <=4.17.23)

lodash-es NPM version =4.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1-alpha.23, =1.0.0, =1.0.0, =2.14.1, =41.3.1, =2.1.0, =0.3.4, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.4.1 and more Source cves: CVE-2025-13465, CVE-2026-2950 Source advisory: OSV:GHSA-F23M-R3PF-42RH...

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

Impact Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the .unset and .omit functions. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties fro...

@dojo/cli-test-intern (>=0.1.0, <=2.0.0-beta3.1), express_mvc (>=4.1.1, <=4.3.10) +7 more potentially affected by CVE-2025-13465 +1 more via lodash-amd (>=4.16.4, <=4.17.23)

lodash-amd NPM version =4.16.4, =0.1.0, =4.1.1, =3.4.0, =0.0.1, =1.0.14, =0.0.7, =0.0.1, =0.1.5 - xirtam--matrix-operations 0.1.3 Source cves: CVE-2025-13465, CVE-2026-2950 Source advisory: OSV:GHSA-F23M-R3PF-42RH...

CVE-2026-4800

A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in .template but did not apply the same validation to options.imports key names. Both paths flow into the same Function constructor sink. Additionally, .template uses assignInWith to merge imports, whi...

CVE-2026-34221

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, a prototype pollution vulnerability exists in the Utils.merge helper used internally by MikroORM when merging object structures. The function did not prevent...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +29 more potentially affected by CVE-2026-34751 via payload (>=3.0.0-alpha.49, <=3.79.0-internal.2874f3f)

payload NPM version =3.0.0-alpha.49, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.3, =1.0.1-beta.0, =1.0.0, =0.1.0, =1.0.0, =3.1.0-types, =1.0.0, =3.64.0, =0.0.1-beta.0, =0.2.0, =0.2.14 and more Source cves: CVE-2026-34751 Source advisory: SNYK:JS-PAYLOAD-15871108...

SUSE-FU-2026:20990-1 Feature update for himmelblau

This update for himmelblau fixes the following issues: Update to himmelblau 2.3.8 jscPED-14511: Security issues: - CVE-2025-54882: world readable cloud TGT token bsc1247735. - CVE-2025-58160: tracing-subscriber: Tracing log pollution bsc1249013. - CVE-2026-25727: time: parsing of user-provided...

Security Bulletin: Multiple Vulnerabilities affect IBM Tivoli Netcool Impact

Summary Multiple vulnerabilities were addressed in IBM Tivoli Netcool Impact version 7.1.0.38 Vulnerability Details CVEID:CVE-2026-29063 DESCRIPTION: Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in...