@ainsleydev/payload-helper (>=0.0.1, <=0.0.2), @bsct/payload (1.0.0) +89 more potentially affected by CVE-2026-41690 via i18next-http-middleware (>=3.0.2, <=3.9.2)

i18next-http-middleware NPM version =3.0.2, =0.0.1, =1.0.1, =0.0.1, =0.0.1, =0.0.1, =8.0.0-alpha1, =3.0.0-rc.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.3 and more Source cves: CVE-2026-41690 Source advisory: SNYK:JS-I18NEXTHTTPMIDDLEWARE-16415526...

@ainsleydev/payload-helper (>=0.0.1, <=0.0.2), @bsct/payload (1.0.0) +89 more potentially affected by CVE-2026-41690 via i18next-http-middleware (>=3.0.2, <=3.9.2)

i18next-http-middleware NPM version =3.0.2, =0.0.1, =1.0.1, =0.0.1, =0.0.1, =0.0.1, =8.0.0-alpha1, =3.0.0-rc.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.3 and more Source cves: CVE-2026-41690 Source advisory: OSV:GHSA-5FGG-JCPF-8JJW...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2163 more potentially affected by CVE-2026-41240 via dompurify (>=3.0.0, <=3.3.3)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =6.3.3 and more Source cves: CVE-2026-41240 Source advisory: OSV:GHSA-H7MW-GPVR-XQ4M...

011xwztpjn (1.0.0), 02y9dg4qm3 (1.0.0) +11557 more potentially affected by CVE-2026-41239 via dompurify (>=1.0.10, <=3.3.3)

dompurify NPM version =1.0.10, =3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on dompurify and may be impacted: - 011xwztpjn 1.0.0 - 02y9dg4qm3 1.0.0 - 04tw75kmd9 1.0.0 - 0650teqqly 1.0.0 - 097oi25ils 1.0.0 - 0a0fpniotn 1.0.0 - 0c7j76u46q 1.0.0 -...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2162 more potentially affected by CVE-2026-41238 via dompurify (>=3.0.1, <=3.3.3)

dompurify NPM version =3.0.1, =0.3.96, =0.5.12, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =6.3.3 and more Source cves: CVE-2026-41238 Source advisory: OSV:GHSA-V9JR-RG53-9PGP...

a11ywatch_cli (>=0.0.26, <=0.7.16), aap (>=0.4.0, <=0.4.1) +3803 more potentially affected by CVE-2026-93599 via rustls-webpki (>=0.100.3, <=0.102.8)

rustls-webpki CARGO version =0.100.3, =0.0.26, =0.4.0, =0.1.0, =0.21.0-alpha.1, =0.1.11, =0.12.1, =0.2.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.2.0 - actix-csrf 0.8.0 and more Source cves: CVE-2026-93599 Source advisory: OSV:RUSTSEC-2026-0104...

@chocolatey-software/astro (2.7.0), @kyro-cms/admin (0.1.2) +8 more potentially affected by CVE-2026-41067 via astro (>=6.0.0-beta.1, <=6.1.5)

astro NPM version =6.0.0-beta.1, =0.19.0, =0.19.0, =1.10.0, =1.0.0, =1.4.2, =0.0.1, =0.0.1, =0.0.7 Source cves: CVE-2026-41067 Source advisory: SNYK:JS-ASTRO-16119128...

@acampkin/mcc (>=2.1.0, <=2.5.0), @kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.6.0) +24 more potentially affected by CVE-2026-39861 via @anthropic-ai/claude-code (>=2.0.0, <=2.1.63)

@anthropic-ai/claude-code NPM version =2.0.0, =2.1.0, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.0.1, =0.4.0, =1.0.29, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =2.0.0 - ch-go 1.0.3 and more Source cves: CVE-2026-39861 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-16191021...

@acampkin/mcc (>=2.1.0, <=2.5.0), @kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.6.0) +24 more potentially affected by CVE-2026-39861 via @anthropic-ai/claude-code (>=2.0.0, <=2.1.63)

@anthropic-ai/claude-code NPM version =2.0.0, =2.1.0, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.0.1, =0.4.0, =1.0.29, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =2.0.0 - ch-go 1.0.3 and more Source cves: CVE-2026-39861 Source advisory: OSV:GHSA-VP62-R36R-9XQP...

@smg-automotive/auth (>=8.2.3, <=9.0.2-support-next-16.2.1) potentially affected by CVE-2026-40155 via @auth0/nextjs-auth0 (>=4.12.1, <=4.17.1)

@auth0/nextjs-auth0 NPM version =4.12.1, =8.2.3, =9.0.2-support-next-16.2.1 Source cves: CVE-2026-40155 Source advisory: OSV:GHSA-XQ8M-7C5P-C2R6...

@alialf/cc-switch (>=1.0.0, <=1.0.1), codex-copilot-dx (>=0.1.0, <=0.1.6) potentially affected by CVE-2026-6662 via copilot-api (0.7.0)

copilot-api NPM version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on copilot-api and may be impacted: - @alialf/cc-switch =1.0.0, =0.1.0, =0.1.6 Source cves: CVE-2026-6662 Source advisory: SNYK:JS-COPILOTAPI-16636640...

@brikcss/rollup-config-generator (>=0.0.15, <=0.0.16), @brikcss/stakcss (>=0.0.0, <=0.9.1) +9 more potentially affected by CVE-2026-6594 via @brikcss/merge (>=1.0.7, <=1.3.0)

@brikcss/merge NPM version =1.0.7, =0.0.15, =0.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.1, =0.2.0, =0.10.0 Source cves: CVE-2026-6594 Source advisory: OSV:GHSA-3JC6-6R48-V6QF...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2162 more potentially affected by CVE-2026-41238 via dompurify (>=3.0.1, <=3.3.3)

dompurify NPM version =3.0.1, =0.3.96, =0.5.12, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =6.3.3 and more Source cves: CVE-2026-41238 Source advisory: SNYK:JS-DOMPURIFY-16132234...

011xwztpjn (1.0.0), 02y9dg4qm3 (1.0.0) +11557 more potentially affected by CVE-2026-41239 via dompurify (>=1.0.10, <=3.3.3)

dompurify NPM version =1.0.10, =3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on dompurify and may be impacted: - 011xwztpjn 1.0.0 - 02y9dg4qm3 1.0.0 - 04tw75kmd9 1.0.0 - 0650teqqly 1.0.0 - 097oi25ils 1.0.0 - 0a0fpniotn 1.0.0 - 0c7j76u46q 1.0.0 -...

1router (>=0.3.96, <=1.0.2), 3d-bin-packing-ts (>=1.0.0, <=1.0.1) +7586 more potentially affected by CVE-2026-41907 via uuid (>=12.0.0, <=13.0.2)

uuid NPM version =12.0.0, =0.3.96, =1.0.0, =2.1.0, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =0.0.1, =0.3.0, =0.4.0, =0.2.0, =0.2.1 - @0xcurvy/curvy-mcp 0.1.0 and more Source cves: CVE-2026-41907 Source advisory: SNYK:JS-UUID-16133035...

@smg-automotive/auth (>=8.2.3, <=9.0.2-support-next-16.2.1) potentially affected by CVE-2026-40155 via @auth0/nextjs-auth0 (>=4.12.1, <=4.17.1)

@auth0/nextjs-auth0 NPM version =4.12.1, =8.2.3, =9.0.2-support-next-16.2.1 Source cves: CVE-2026-40155 Source advisory: SNYK:JS-AUTH0NEXTJSAUTH0-16109571...

@chrysb/alphaclaw (>=0.8.8, <=0.9.5), @twsxtd/hapi-openclaw (>=0.1.0, <=0.1.8) +2 more potentially affected by CVE-2026-41389 via openclaw (>=2026.4.9, <=2026.4.12)

openclaw NPM version =2026.4.9, =0.8.8, =0.1.0, =0.1.8 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-41389 Source advisory: OSV:GHSA-MR34-9552-QR95...

@chrysb/alphaclaw (>=0.8.8, <=0.9.5), @twsxtd/hapi-openclaw (>=0.1.0, <=0.1.8) +2 more potentially affected by CVE-2026-41389 via openclaw (>=2026.4.9, <=2026.4.12)

openclaw NPM version =2026.4.9, =0.8.8, =0.1.0, =0.1.8 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-41389 Source advisory: SNYK:JS-OPENCLAW-16109680...

built-in-math-eval (>=0.1.0, <=0.3.1), function-plot (>=1.0.0, <=1.14.0) +1 more potentially affected by CVE-2026-41507 via math-codegen (>=0.2.5, <=0.4.2)

math-codegen NPM version =0.2.5, =0.1.0, =1.0.0, =0.2.0, =0.5.2 Source cves: CVE-2026-41507 Source advisory: OSV:GHSA-P6X5-P4XF-CC4R...

built-in-math-eval (>=0.1.0, <=0.3.1), function-plot (>=1.0.0, <=1.14.0) +1 more potentially affected by CVE-2026-41507 via math-codegen (>=0.2.5, <=0.4.2)

math-codegen NPM version =0.2.5, =0.1.0, =1.0.0, =0.2.0, =0.5.2 Source cves: CVE-2026-41507 Source advisory: SNYK:JS-MATHCODEGEN-16420747...